CVE-2026-119980

Name of the Vulnerable Software and Affected Versions UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress versions prior to 1.2.79

Description Unauthorized account access is possible due to the use of predictable passwords for built-in dummy user accounts. The function get dummy user passowrd() generates a shared password based on a hash of the AUTH KEY and site url(). The full hash value is exposed in the hidden uwp register hash field within registration form responses. This information is accessible without authentication via the /register/ endpoint and the wp ajax nopriv uwp ajax register form AJAX handler, regardless of whether user registration is enabled. An attacker can recover the password from a single HTTP request and authenticate as any of the 25 dummy accounts through wp-login.php, which may lead to privilege escalation if a dummy account has an elevated role. This issue only affects sites where an administrator has created dummy users via the Tools page.

Recommendations Update the plugin to version 1.2.79 or later.