---
id: "CVE-2026-119980"
kind: "vulnerability"
aliases: ["CVE-2026-119980"]
title: "WordPress UsersWP plugin: predictable password lets anyone log into dummy accounts"
severity: "medium"
cvss: 6.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "userswp", "wordpress"]
not_affected_if: ["no-dummy-users-created", "plugin-newer-than-1.2.78"]
published_at: "2026-10-31T07:16:36+00:00"
first_seen_at: "2026-10-31T07:34:07+00:00"
updated_at: "2026-10-31T07:34:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119980", "first_seen_at": "2026-10-31T07:34:07+00:00"}]
---

# WordPress UsersWP plugin: predictable password lets anyone log into dummy accounts

The UsersWP WordPress plugin derives one shared password for its 25 built-in dummy user accounts from a hash that it also prints in a hidden field on public registration forms. An unauthenticated attacker can read that hash from one request and log in as any dummy account, possibly gaining elevated access if one holds a higher role.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the UsersWP plugin is installed and its version is `1.2.78` or lower.
- Check whether dummy users were created via the plugin's Tools page (look for accounts such as antawn, chynna, or kiki in the WordPress users list).
- Check whether any dummy account holds an elevated role.

## Timeline

- 2026-10-31T07:34:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119980

## From the sources

The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to unauthorized account access via Use of Predictable Password in all versions up to, and including, 1.2.78 The vulnerability exists because `get_dummy_user_passowrd()` derives the shared password for all 25 built-in dummy user accounts as the first 15 characters of `substr(hash('SHA256', AUTH_KEY . site_url()), 0, 25)`, while the full 25-character value of that same hash is simultaneously embedded in the hidden `uwp_register_hash` field rendered on every registration form response — reachable without authentication via both the public `/register/` page and the `wp_ajax_nopriv_uwp_ajax_register_form` AJAX handler, even when user registration is disabled. This makes it possible for unauthenticated attackers to recover the dummy user password directly from a single HTTP request and use it to authenticate as any of the 25 built-in dummy accounts (such as antawn, chynna, or kiki) through `wp-login.php`, potentially achieving privilege escalation if any dummy account holds an elevated role. Exploitation requires that an administrator has previously created dummy users via the plugin's Tools page.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_