UsersWP vulnerabilities
We track 2 vulnerabilities in UsersWP products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 19, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest UsersWP vulnerabilities
- 8.1 High severity
UsersWP: Improper Privilege Management
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrato
- 7.4 High severity
UsersWP: Improper Authentication
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.