Quick answers
- Is CVE-2026-119980 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-119980 being exploited in the wild.
- How severe is CVE-2026-119980?
- Medium severity, with a CVSS score of 6.5, published 31 October 2026.
- Which products and versions are affected?
- AyeCode UsersWP up to and including 1.2.78.
- Is there a fix for CVE-2026-119980?
- No fixed version is recorded yet. Do not create dummy user accounts via the plugin's Tools page unless necessary; if they exist, ensure no dummy account is assigned an elevated role (administrator, editor, or custom privileged roles). If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-119980 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-119980?
- Check whether you run AyeCode UsersWP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
Do not create dummy user accounts via the plugin's Tools page unless necessary; if they exist, ensure no dummy account is assigned an elevated role (administrator, editor, or custom privileged roles).
Technical details
The plugin derives all 25 built-in dummy user passwords from the first 15 characters of a SHA256 hash derived from AUTH_KEY and site_url(), while embedding the full 25-character hash value in the public registration form HTML. An unauthenticated attacker can obtain the hash via GET/POST to /register/ or the wp_ajax_nopriv_uwp_ajax_register_form AJAX handler without authentication, compute the dummy password offline, and authenticate via wp-login.php. Privilege escalation is possible if any dummy account holds an elevated role.
Affected products
- AyeCode UsersWP up to and including 1.2.78
Timeline
- 2026-10-31: disclosed