CVE-2026-110963

Summary

The Userplace WordPress plugin (≤1.2.0) exposes a nonce and lacks authorization checks on an AJAX endpoint accessible to unauthenticated users, enabling anyone to create admin accounts or modify site options. This allows complete site compromise without authentication.

Exploitability

Trivial to exploit; requires only sending a single HTTP request with the publicly exposed nonce to the vulnerable AJAX endpoint.

Blast radius

Successful exploitation grants full administrative control of the WordPress site, enabling data exfiltration, malware deployment, or persistent backdoor installation.

Detection

Look for repeated POST requests to wp-admin/admin-ajax.php targeting the 'userplace_' AJAX action from unauthenticated IP addresses, especially with identical nonce values in the request body, alongside subsequent creation of new administrator accounts or unexpected changes to site options in WordPress audit logs.

Prioritized remediation

Upgrade to Userplace plugin version 1.2.1 or later; if unavailable, immediately disable the affected AJAX action and restrict access to authenticated users with appropriate capabilities.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.