{"id":"CVE-2026-110963","published":"2026-11-08T06:17:04.673","lastModified":"2026-11-10T16:28:46.510","description":"The Userplace  WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-269"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/c30f71d3-2ec4-4bee-8864-f7c19cf6fcb7/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Userplace WordPress plugin (≤1.2.0) exposes a nonce and lacks authorization checks on an AJAX endpoint accessible to unauthenticated users, enabling anyone to create admin accounts or modify site options. This allows complete site compromise without authentication.","exploitability":"Trivial to exploit; requires only sending a single HTTP request with the publicly exposed nonce to the vulnerable AJAX endpoint.","blast_radius":"Successful exploitation grants full administrative control of the WordPress site, enabling data exfiltration, malware deployment, or persistent backdoor installation.","remediation":"Upgrade to Userplace plugin version 1.2.1 or later; if unavailable, immediately disable the affected AJAX action and restrict access to authenticated users with appropriate capabilities.","detection":"Look for repeated POST requests to wp-admin/admin-ajax.php targeting the 'userplace_' AJAX action from unauthenticated IP addresses, especially with identical nonce values in the request body, alongside subsequent creation of new administrator accounts or unexpected changes to site options in WordPress audit logs.","tags":["auth-bypass","csrf","wordpress","ajax","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-11-09T09:42:54.398Z"}}