CVE-2026-86814: CWE-269 Improper Privilege Management in UsersWP
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
AI Analysis
Technical Summary
CVE-2026-86814 describes a privilege management vulnerability (CWE-269) in the UsersWP WordPress plugin prior to version 1.5.10. The plugin does not properly verify email ownership confirmation from social login providers before associating the email with an existing user account. This allows unauthenticated attackers to bypass authentication and log in as any user, including administrators, by asserting an email address they control via a social login provider account.
Potential Impact
An attacker can gain unauthorized access to any user account, including administrator accounts, without authentication. This can lead to full site compromise, data exposure, and unauthorized administrative actions within the WordPress environment.
Mitigation Recommendations
Users should upgrade the UsersWP plugin to version 1.5.10 or later where this vulnerability is fixed. No other mitigation guidance is provided. Patch status is confirmed by the affectedVersions field indicating versions before 1.5.10 are vulnerable.
CVE-2026-86814: CWE-269 Improper Privilege Management in UsersWP
Description
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
CVSS v3.1
Score 8.1high
Affected software
UsersWP
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-86814 describes a privilege management vulnerability (CWE-269) in the UsersWP WordPress plugin prior to version 1.5.10. The plugin does not properly verify email ownership confirmation from social login providers before associating the email with an existing user account. This allows unauthenticated attackers to bypass authentication and log in as any user, including administrators, by asserting an email address they control via a social login provider account.
Potential Impact
An attacker can gain unauthorized access to any user account, including administrator accounts, without authentication. This can lead to full site compromise, data exposure, and unauthorized administrative actions within the WordPress environment.
Mitigation Recommendations
Users should upgrade the UsersWP plugin to version 1.5.10 or later where this vulnerability is fixed. No other mitigation guidance is provided. Patch status is confirmed by the affectedVersions field indicating versions before 1.5.10 are vulnerable.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-08T13:39:26.267Z
- State
- PUBLISHED
Threat ID: 6aae2c6755bf5e2cf5363ad8
Added to database: 09/19/2026, 06:32:07 UTC
Last enriched: 09/19/2026, 06:47:06 UTC
Last updated: 09/19/2026, 22:01:38 UTC
Views: 53
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.