UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.78 - Unauthenticated Authentication Bypass via Dummy User Password Exposed in Registration Form

ID

WPSEC-2026-2171

Plugin

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP (userswp)

Affected

all versions before 1.2.79

Remediation

Update to 1.2.79 or later.

CVSS 3.1

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness

CWE-1391

Usage

Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-31

Attack surface

UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP on WPSec AttackSurface

Fix released

2026-10-30

Published

2026-10-31

Description

The UsersWP plugin for WordPress is vulnerable to Authentication Bypass via the dummy test users feature in all versions up to, and including, 1.2.78, due to every dummy user being given the same password, substr(hash('SHA256', AUTH_KEY . site_url()), 0, 15). The plugin prints the first 25 characters of that same hash in the hidden 'uwp_register_hash' field of its public registration form, so anyone who can view the form can read the password. This makes it possible for unauthenticated attackers to log in as any dummy user, whose usernames are fixed and publicly known, and act with that account's privileges, provided an administrator has generated dummy users.

References

• https://wpsec.com/vuln/WPSEC-2026-2171/
• https://plugins.svn.wordpress.org/userswp/tags/1.2.79/
• https://wordpress.org/plugins/userswp/

Published by WPSec. Provided as is, without warranty. Corrections: contact us.

This advisory as JSON or Markdown · All advisories: JSON, RSS