What’s Vulnerable › Vulnerabilities
CVE-2026-86814: UsersWP - Social Login < 1.5.10 - Unauthenticated Account Takeover via Unverified Provider Email
- Severity: high (CVSS 8.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-19 · updated 2026-09-21
- Weakness: CWE-269
Description
The UsersWP WordPress plugin before 1.5.10 does not verify that a social login provider has confirmed ownership of an email address before using it to resolve an existing account, allowing unauthenticated attackers to log in as any user, including administrators, whose email address they can assert through a provider account of their own.
Affected products
- stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP: before 1.5.10 — fixed in 1.5.10
How to fix
Upgrade to a fixed version: stiofansisland UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WP 1.5.10. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-86814 or the next vulnerability affects your stack