# UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP <= 1.2.78 - Unauthenticated Authentication Bypass via Dummy User Password Exposed in Registration Form

- **ID:** WPSEC-2026-2171
- **Plugin:** UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP (`userswp`), https://wordpress.org/plugins/userswp/
- **Affected versions:** all versions before 1.2.79
- **Fixed in:** 1.2.79 (Update to 1.2.79 or later.)
- **Severity:** Medium 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-1391
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-31)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/userswp
- **Fix released:** 2026-10-30
- **Published:** 2026-10-31
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2171/

## Description

The UsersWP plugin for WordPress is vulnerable to Authentication Bypass via the dummy test users feature in all versions up to, and including, 1.2.78, due to every dummy user being given the same password, substr(hash('SHA256', AUTH_KEY . site_url()), 0, 15). The plugin prints the first 25 characters of that same hash in the hidden 'uwp_register_hash' field of its public registration form, so anyone who can view the form can read the password. This makes it possible for unauthenticated attackers to log in as any dummy user, whose usernames are fixed and publicly known, and act with that account's privileges, provided an administrator has generated dummy users.

Also published later by wordfence as CVE-2026-119980.

## References

- https://wpsec.com/vuln/WPSEC-2026-2171/
- https://plugins.svn.wordpress.org/userswp/tags/1.2.79/
- https://wordpress.org/plugins/userswp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2171/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.