CVE-2026-110963: Userplace Plugin, Critical Privilege Escalation

CVE-2026-110963 identifies an authorization vulnerability in the Userplace plugin for WordPress. The flaw allows an unauthenticated attacker to interact with an AJAX action without authorization by exploiting a publicly exposed nonce. The plugin fails to verify user credentials before processing the request, enabling the creation of administrator accounts or modification of critical site configurations.

The CVSS score is 9.8 (critical), the highest impact rating for vulnerabilities. The plugin is affected up to version 1.2.0. As of 2026-11-08, no patch has been released: signals on X actively report that no official solution exists. This means every active plugin installation remains completely vulnerable to a straightforward attack requiring no credentials.

Administrators must immediately disable the Userplace plugin until an official patch becomes available. It is essential to audit access logs, administrator user creation records, and site option modifications to identify whether exploitation has occurred. At the preventive level, implement robust authorization controls on all AJAX actions, preferably at the server middleware level, and maintain awareness of plugin security releases through official channels.