{"id":"CVE-2026-110963","kind":"vulnerability","aliases":["CVE-2026-110963"],"related":[],"title":"Userplace WordPress plugin lets anyone create an administrator account","description":"The Userplace  WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.","summary":"The Userplace WordPress plugin through version 1.2.0 has an AJAX action open to unauthenticated users with no authorization check, and it exposes the nonce that protects it. An anonymous visitor can create an administrator account or write arbitrary site options, which gives full control of the site.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"userplace-member-subscription-restriction-payments","fixed":[],"affected":"<= 1.2.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","userplace","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- In wp-admin > Plugins, look for 'Userplace – Member Subscription, Restriction & Payments' (slug userplace-member-subscription-restriction-payments); any installed version (1.2.0 is the latest) is affected. WP-CLI: wp plugin list --name=userplace-member-subscription-restriction-payments\n- Review Users > Administrators for accounts nobody on the team created, and check Settings > General (default role, registration) and wp_options for unexpected changes (the flaw can write arbitrary options).","fix":"No patched version known. Version 1.2.0 is the latest release and WordPress.org has closed the plugin (as of Oct 23, 2026, pending review). Deactivate and delete the plugin until the vendor (redq) ships a fix.","status":"open","published_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","triaged_at":"2026-11-08T06:47:18+00:00","updated_at":"2026-11-08T06:48:46+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-08T06:47:18Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Userplace WordPress plugin lets anyone create an administrator account","impact":"high","summary":"The Userplace WordPress plugin through version 1.2.0 has an AJAX action open to unauthenticated users with no authorization check, and it exposes the nonce that protects it. An anonymous visitor can create an administrator account or write arbitrary site options, which gives full control of the site.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","userplace","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"anonymous visitors gain admin accounts and full site takeover","analyst_note":"Confirm the fixed version or removal guidance for Userplace 1.2.0 at the NVD entry or the plugin's WordPress.org page.","how_to_check":"- Check whether the Userplace plugin is installed and its version is `1.2.0` or earlier in the WordPress plugins screen or the plugin's main file header.\n- Review the site's user list for administrator accounts that nobody on the team created.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Any WordPress site running the Userplace plugin at version 1.2.0 or earlier is exposed, because the vulnerable AJAX action is reachable without logging in. Sites that do not have the plugin installed are not affected. The sources do not state a fixed version or a workaround.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"critical"},"cost_usd":0.000733,"input_tokens":4547,"output_tokens":557,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version or removal guidance for Userplace 1.2.0 at the NVD entry or the plugin's WordPress.org page.","search":"'-110963':12A,15A '-2026':11A,14A '1.2.0':34B,80C 'account':9A,62B,109C 'action':38B,89C 'administr':8A,61B,108C 'ajax':37B,88C 'allow':102C 'anonym':56B 'anyon':5A 'arbitrari':65B,112C 'attack':104C 'author':45B,84C 'avail':90C 'check':46B,85C 'control':71B 'creat':6A,59B,106C 'cve':10A,13A 'expos':49B,96C 'full':70B,117C 'give':69B 'host':25B 'lead':115C 'let':4A 'member':18A 'nonc':51B,98C 'open':39B 'option':67B,114C 'packag':22B 'payments':21A 'perform':83C 'plugin':3A,31B,78C 'protect':53B,100C 'public':95C 'restriction':20A 'self':24B 'self-host':23B 'site':66B,74B,113C,118C 'subscription':19A 'takeov':119C 'unauthent':41B,92C,103C 'user':42B,93C 'userplac':1A,26B,29B,76C 'userplace':17A 'userplace-member-subscription-restriction-payments':16A 'version':33B 'visitor':57B 'wordpress':2A,27B,30B,77C 'write':64B,111C","nicknames":[],"mitigations":[],"who_affected":"Any WordPress site running the Userplace plugin at version 1.2.0 or earlier is exposed, because the vulnerable AJAX action is reachable without logging in. Sites that do not have the plugin installed are not affected. The sources do not state a fixed version or a workaround.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["userplacemembersubscriptionrestrictionpayments"],"ptokens":["member","payments","restriction","subscription","userplace"],"labels":["critical","package","selfhosted","userplace","wordpress"],"campaign_type":null,"search_a":"'-110963':12A,15A '-2026':11A,14A 'account':9A 'administr':8A 'anyon':5A 'creat':6A 'cve':10A,13A 'let':4A 'member':18A 'payments':21A 'plugin':3A 'restriction':20A 'subscription':19A 'userplac':1A 'userplace':17A 'userplace-member-subscription-restriction-payments':16A 'wordpress':2A","search_b":"'1.2.0':34B 'account':62B 'action':38B 'administr':61B 'ajax':37B 'anonym':56B 'arbitrari':65B 'author':45B 'check':46B 'control':71B 'creat':59B 'expos':49B 'full':70B 'give':69B 'host':25B 'nonc':51B 'open':39B 'option':67B 'packag':22B 'plugin':31B 'protect':53B 'self':24B 'self-host':23B 'site':66B,74B 'unauthent':41B 'user':42B 'userplac':26B,29B 'version':33B 'visitor':57B 'wordpress':27B,30B 'write':64B","search_c":"'1.2.0':80C 'account':109C 'action':89C 'administr':108C 'ajax':88C 'allow':102C 'arbitrari':112C 'attack':104C 'author':84C 'avail':90C 'check':85C 'creat':106C 'expos':96C 'full':117C 'lead':115C 'nonc':98C 'option':114C 'perform':83C 'plugin':78C 'protect':100C 'public':95C 'site':113C,118C 'takeov':119C 'unauthent':92C,103C 'user':93C 'userplac':76C 'wordpress':77C 'write':111C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T06:17:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110963","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110963","severity":null,"published_at":"2026-11-08T06:17:04+00:00","modified_at":"2026-11-08T06:17:04+00:00","first_seen_at":"2026-11-08T06:46:21+00:00","fetched_at":"2026-11-08T06:46:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110963:2166","url":"https://wordpress.org/plugins/userplace-member-subscription-restriction-payments/","severity":null,"published_at":"2026-11-08T06:48:46+00:00","modified_at":"2026-11-08T06:48:46+00:00","first_seen_at":"2026-11-08T06:48:46+00:00","fetched_at":"2026-11-08T06:48:46+00:00","note":"NVD gives no fix. WordPress.org page (read) shows version 1.2.0 as the latest and the plugin closed since Oct 23, 2026 pending review; no fixed version exists. No vendor advisory, PoC or exploitation found. Not marked verified: no vendor advisory text. Fix_status none is based on the WordPress.org page.","cites":["https://wordpress.org/plugins/userplace-member-subscription-restriction-payments/","https://nvd.nist.gov/vuln/detail/CVE-2026-110963"]}],"documents":[{"id":100285,"url":"https://wordpress.org/plugins/userplace-member-subscription-restriction-payments/","title":"Userplace plugin page (WordPress.org): closed, latest 1.2.0","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":100286,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110963","title":"NVD CVE-2026-110963","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}