{
 "id": "WPSEC-2026-2171",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2171/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2171/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2171/index.md",
 "title": "UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.78 - Unauthenticated Authentication Bypass via Dummy User Password Exposed in Registration Form",
 "description": "The UsersWP plugin for WordPress is vulnerable to Authentication Bypass via the dummy test users feature in all versions up to, and including, 1.2.78, due to every dummy user being given the same password, substr(hash('SHA256', AUTH_KEY . site_url()), 0, 15). The plugin prints the first 25 characters of that same hash in the hidden 'uwp_register_hash' field of its public registration form, so anyone who can view the form can read the password. This makes it possible for unauthenticated attackers to log in as any dummy user, whose usernames are fixed and publicly known, and act with that account's privileges, provided an administrator has generated dummy users.",
 "plugin": {
  "slug": "userswp",
  "name": "UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP",
  "full_name": "UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP",
  "wordpress_org": "https://wordpress.org/plugins/userswp/",
  "advisories_url": "https://wpsec.com/vuln/plugin/userswp/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/userswp"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-1391"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.8,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.2.79",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.2.79"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.2.79",
 "remediation": "Update to 1.2.79 or later.",
 "fix_released": "2026-10-30T05:49:18+00:00",
 "published": "2026-10-31T06:40:41+00:00",
 "updated": "2026-10-30T09:24:15.342921+00:00",
 "also_published_as": {
  "source": "wordfence",
  "cve": [
   "CVE-2026-119980"
  ],
  "published": "2026-10-30T17:58:07+00:00"
 },
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2171/",
  "https://plugins.svn.wordpress.org/userswp/tags/1.2.79/",
  "https://wordpress.org/plugins/userswp/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/userswp",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-31"
 }
}