CVE-2026-110963

Name of the Vulnerable Software and Affected Versions Userplace versions prior to 1.2.1

Description The Userplace WordPress plugin fails to perform authorization checks on an AJAX action accessible to unauthenticated users. Additionally, the nonce (a unique token used to prevent cross-site request forgery) that protects this action is publicly exposed. This allows unauthenticated attackers to create an administrator account or write arbitrary site options, which can lead to a full site takeover.

Recommendations Disable the plugin. Restrict exposure of the affected component. Review new administrator accounts for unauthorized entries.