EUVD Vulnerability Catalog

EUVD-2026-68042

Severity: CRITICAL Base Score: 9.8 CVSS Version: 3.1

Vulnerability Description

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.

CVSS Vector Analysis

Below is the complete, human-readable breakdown of the CVSS metric string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

▪ Attack Vector (AV): Network

▪ Attack Complexity (AC): Low

▪ Privileges Required (PR): None

▪ User Interaction (UI): None

▪ Scope (S): Unchanged

▪ Confidentiality Impact (C): High

▪ Integrity Impact (I): High

▪ Availability Impact (A): High

Affected Vendors & Systems

Vendor Unknown

References & Advisory Links

https://wpscan.com/vulnerability/e551128c-c9b1-4e6a-a2aa-92830b7a4887/

Metadata Profile

Database Authority

European Union Agency for Cybersecurity (ENISA) EUVD

Assigner

WPScan

EPSS Probability

0.14

Known Aliases

GHSA-p38m-pp69-pr2w CVE-2026-16259

Published On

2026-08-29

Last Updated

2026-08-30