Skip to content
Sign in
8.1 High

CVE-2026-86814 The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an…

Description

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.

Affected products and versions

Product Affected versions Fixed in
UsersWP 1.5 earliest → < 1.5.10 1.5.10

Other CVEs of UsersWP

The 3 CVEs of UsersWP →
CVE-2026-13690 The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor… 7.4 High CVE-2024-6477 The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could… 7.5 High
Track this CVE