A critical flaw in the Userplace plugin for WordPress lets anyone on the internet create an administrator account on an affected site, without logging in. The vulnerability, tracked as CVE-2026-110963, was published on 8 November 2026 and scores 9.8 out of 10, the top end of the severity scale.

The flaw is an unauthenticated privilege escalation. According to the CVE record, the plugin does not perform authorisation checks on an AJAX action that is available to logged-out users, and it publicly exposes the nonce that is supposed to protect that action. An attacker can use the unprotected action to create an administrator account, or to write arbitrary site options, either of which leads to full takeover of the site.

No fix listed yet

What makes the flaw especially worrying is that the CVE record lists no fixed version. Site owners running Userplace through version 1.2.0 are affected, and at the time the record was last updated on 8 November, no patch had been published. That leaves affected sites with limited options: remove the plugin, or restrict access to the site's administration area to trusted users only until a fix appears.

CISA's assessment, published on 8 November, rates the flaw as automatable with total technical impact, meaning an attacker could exploit it at scale and gain complete control of a vulnerable site. No public exploit code has been tracked on Exploit-DB, Metasploit or GitHub, and the flaw is not in CISA's Known Exploited Vulnerabilities catalogue, so there is no confirmed evidence of attacks in the wild yet. That is no reason for comfort: flaws of this kind, which need no login and no user interaction, are routinely picked up by automated scanners soon after disclosure.

Part of a wider pattern

CVE-2026-110963 is one of several WordPress plugin flaws published on 8 November, and it follows a familiar pattern in which a plugin's AJAX handlers, the background requests WordPress uses for interactive features, are left open to visitors who should never reach them. Site administrators should treat any plugin that offers user registration, profile management or account features as a priority for updates, and should check whether their sites run Userplace at all.

Until a fixed version is released, the safest step for sites using Userplace is to deactivate and remove the plugin, and to review administrator accounts for any that were not created by the site owner. Any unfamiliar admin account should be removed immediately, and all remaining administrator passwords should be reset.