Aller au contenu
Se connecter
8.1 Élevée

CVE-2026-86814 The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an…

Description

The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.

Produits et versions touchés

Produit Versions touchées Corrigé en
UsersWP 1.5 premières → < 1.5.10 1.5.10

Autres CVE de UsersWP

Les 3 CVE de UsersWP →
CVE-2026-13690 The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor… 7.4 Élevée CVE-2024-6477 The UsersWP WordPress plugin before 1.2.12 uses predictable filenames when an admin generates an export, which could… 7.5 Élevée
Suivre cette CVE