---
id: "CVE-2026-110963"
page: "https://infrastack.ai/live/CVE-2026-110963"
kind: "vulnerability"
aliases: ["CVE-2026-110963"]
title: "Userplace WordPress plugin lets anyone create an administrator account"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "userplace-member-subscription-restriction-payments", "fixed": [], "affected": "<= 1.2.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "userplace", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-08T06:17:04+00:00"
first_seen_at: "2026-11-08T06:46:21+00:00"
updated_at: "2026-11-08T06:48:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110963", "first_seen_at": "2026-11-08T06:46:21+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110963", "first_seen_at": "2026-11-08T06:48:46+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-110963", "https://wordpress.org/plugins/userplace-member-subscription-restriction-payments/"]}]
exploit_sources: []
---

# Userplace WordPress plugin lets anyone create an administrator account

Link for people: https://infrastack.ai/live/CVE-2026-110963 (this .md is for agents)

The Userplace WordPress plugin through version 1.2.0 has an AJAX action open to unauthenticated users with no authorization check, and it exposes the nonce that protects it. An anonymous visitor can create an administrator account or write arbitrary site options, which gives full control of the site.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:userplace-member-subscription-restriction-payments affected <= 1.2.0 fixed no fixed version listed

## How to check

- In wp-admin > Plugins, look for 'Userplace – Member Subscription, Restriction & Payments' (slug userplace-member-subscription-restriction-payments); any installed version (1.2.0 is the latest) is affected. WP-CLI: wp plugin list --name=userplace-member-subscription-restriction-payments
- Review Users > Administrators for accounts nobody on the team created, and check Settings > General (default role, registration) and wp_options for unexpected changes (the flaw can write arbitrary options).

## Fix

No patched version known. Version 1.2.0 is the latest release and WordPress.org has closed the plugin (as of Oct 23, 2026, pending review). Deactivate and delete the plugin until the vendor (redq) ships a fix.

## Timeline

- 2026-11-08T06:46:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110963
- 2026-11-08T06:48:46+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-110963 — NVD gives no fix. WordPress.org page (read) shows version 1.2.0 as the latest and the plugin closed since Oct 23, 2026 pending review; no fixed version exists. No vendor advisory, PoC or exploitation found. Not marked verified: no vendor advisory text. Fix_status none is based on the WordPress.org page.

## Documents

- [advisory] NVD CVE-2026-110963 https://nvd.nist.gov/vuln/detail/CVE-2026-110963
- [fix] Userplace plugin page (WordPress.org): closed, latest 1.2.0 https://wordpress.org/plugins/userplace-member-subscription-restriction-payments/

## From the sources

The Userplace  WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_