Live › vulnerability › CVE-2026-119980
The UsersWP WordPress plugin derives one shared password for its 25 built-in dummy user accounts from a hash that it also prints in a hidden field on public registration forms. An unauthenticated attacker can read that hash from one request and log in as any dummy account, possibly gaining elevated access if one holds a higher role.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-31 07:34 UTC. All times on this page are UTC.
Sites running the UsersWP plugin at version 1.2.78 or earlier where an administrator has created dummy users through the plugin's Tools page. The exposure is on the public registration form and AJAX endpoint, even when user registration is disabled. Sites that never created dummy users are not exposed through this path.
No product ranges from the sources yet.
1.2.78 or lower.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because get_dummy_user_passowrd() derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25), while the full 25-character value of that same hash is simultaneously embedded in the hidden uwp_register_hash field rendered on every registration form response — reachable without authentication via both the public /register/ page and the wp_ajax_nopriv_uwp_ajax_register_form AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through wp-login.php, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.
This page as .md · .json · in your agent: get_signal("CVE-2026-119980")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.