CVE-2026-110963

{
  "etk_id": "ETK-2026-3882",
  "cve_id": "CVE-2026-110963",
  "display_id": "CVE-2026-110963",
  "ghsa_id": "GHSA-78p4-p67c-wwv7",
  "euvd_id": "EUVD-2026-119478",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated AJAX authorization bypass in Userplace",
  "summary": "Userplace WordPress plugin versions through 1.2.0 expose an AJAX operation without adequate authorization controls. An unauthenticated attacker who can reach the affected site may create an administrator account or alter site options, potentially taking control of the site.",
  "mitigation": "Disable the Userplace plugin until the maintainer provides a corrected release. Restrict public access to the affected WordPress site or its AJAX endpoint where operationally feasible.",
  "vendor": null,
  "product": "Userplace",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 1.2.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Userplace",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 18.84790115,
  "t0_at": "2026-11-08T06:00:31.251000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-08T06:00:31.251000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-08T06:00:31.251000+00:00",
      "url": "https://github.com/advisories/GHSA-78p4-p67c-wwv7"
    }
  }
}