{"id":"CVE-2026-119980","kind":"vulnerability","aliases":["CVE-2026-119980"],"related":[],"title":"WordPress UsersWP plugin: predictable password lets anyone log into dummy accounts","description":"The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response — reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.","summary":"The UsersWP WordPress plugin derives one shared password for its 25 built-in dummy user accounts from a hash that it also prints in a hidden field on public registration forms. An unauthenticated attacker can read that hash from one request and log in as any dummy account, possibly gaining elevated access if one holds a higher role.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","userswp","wordpress"],"not_affected_if":["no-dummy-users-created","plugin-newer-than-1.2.78"],"how_to_check":"- Check whether the UsersWP plugin is installed and its version is `1.2.78` or lower.\n- Check whether dummy users were created via the plugin's Tools page (look for accounts such as antawn, chynna, or kiki in the WordPress users list).\n- Check whether any dummy account holds an elevated role.","fix":null,"status":"open","published_at":"2026-10-31T07:16:36+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","triaged_at":"2026-10-31T07:34:38+00:00","updated_at":"2026-10-31T07:34:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-31T07:34:38Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress UsersWP plugin: predictable password lets anyone log into dummy accounts","impact":"high","summary":"The UsersWP WordPress plugin derives one shared password for its 25 built-in dummy user accounts from a hash that it also prints in a hidden field on public registration forms. An unauthenticated attacker can read that hash from one request and log in as any dummy account, possibly gaining elevated access if one holds a higher role.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","userswp","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker logs in as dummy accounts, possibly with elevated roles","analyst_note":"Sources list only NVD; check the plugin's changelog or vendor advisory for the fixed version and whether dummy accounts and the Tools page were removed.","how_to_check":"- Check whether the UsersWP plugin is installed and its version is `1.2.78` or lower.\n- Check whether dummy users were created via the plugin's Tools page (look for accounts such as antawn, chynna, or kiki in the WordPress users list).\n- Check whether any dummy account holds an elevated role.","plain_action":"","needs_analyst":true,"not_affected_if":["no-dummy-users-created","plugin-newer-than-1.2.78"],"who_is_affected":"Sites running the UsersWP plugin at version 1.2.78 or earlier where an administrator has created dummy users through the plugin's Tools page. The exposure is on the public registration form and AJAX endpoint, even when user registration is disabled. Sites that never created dummy users are not exposed through this path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000761,"input_tokens":4444,"output_tokens":633,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119980':14A,17A '-2026':13A,16A '/register':187C '0':152C '1.2.78':117C '15':142C '25':34B,132C,153C,157C,234C 'access':76B,104C 'account':11A,40B,72B,103C,138C,239C,255C 'achiev':249C 'administr':264C 'ajax':192C,195C,198C 'also':46B 'antawn':242C 'anyon':7A 'attack':58B,212C 'auth':148C 'authent':182C,229C 'built':36B,134C,236C 'built-in':35B,133C,235C 'charact':143C,158C 'chynna':243C 'creat':267C 'cve':12A,15A 'deriv':28B,126C 'direct':219C 'directori':95C 'disabl':205C 'dummi':10A,38B,71B,123C,136C,216C,238C,254C,268C 'elev':75B,258C 'embed':166C 'end':87C 'escal':251C 'even':200C 'everi':176C 'exist':120C 'exploit':260C 'field':51B,173C 'first':141C 'form':55B,89C,178C,197C 'front':86C 'front-end':85C 'full':156C 'gain':74B 'get':122C 'handler':199C 'hash':43B,62B,146C,163C,172C 'hidden':50B,169C 'higher':81B 'hold':79B,256C 'host':21B 'http':223C 'includ':116C 'key':149C 'kiki':245C 'let':6A 'log':8A,67B 'login':88C 'make':207C 'member':94C 'nopriv':193C 'one':29B,64B,78B 'packag':18B 'page':188C,275C 'passowrd':125C 'password':5A,31B,109C,129C,218C 'plugin':3A,27B,96C,272C 'possibl':73B,209C 'potenti':248C 'predict':4A,108C 'previous':266C 'print':47B 'privileg':250C 'profil':93C 'public':53B,186C 'reachabl':180C 'read':60B 'recov':214C 'regist':171C,196C 'registr':54B,91C,177C,203C 'render':174C 'request':65B,224C 'requir':261C 'respons':179C 'role':82B,259C 'self':20B 'self-host':19B 'sha256':147C 'share':30B,128C 'simultan':165C 'singl':222C 'site':150C 'substr':145C 'tool':274C 'unauthent':57B,211C 'unauthor':102C 'url':151C 'use':106C,226C 'user':39B,90C,92C,124C,137C,202C,217C,269C 'userswp':2A,22B,25B,84C 'uwp':170C,194C 'valu':159C 'version':112C 'via':105C,183C,270C 'vulner':100C,119C 'without':181C 'wordpress':1A,23B,26B,98C 'wp':191C 'wp-login.php':247C","nicknames":[],"mitigations":[],"who_affected":"Sites running the UsersWP plugin at version 1.2.78 or earlier where an administrator has created dummy users through the plugin's Tools page. The exposure is on the public registration form and AJAX endpoint, even when user registration is disabled. Sites that never created dummy users are not exposed through this path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-31T07:16:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119980","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119980","severity":null,"published_at":"2026-10-31T07:16:36+00:00","modified_at":"2026-10-31T07:16:36+00:00","first_seen_at":"2026-10-31T07:34:07+00:00","fetched_at":"2026-10-31T07:34:07+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}