Quick answers
- Is CVE-2026-13690 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-13690 being exploited in the wild.
- How severe is CVE-2026-13690?
- Informational severity, with a CVSS score of 7.1, published 29 July 2026.
- Which products and versions are affected?
- UsersWP UsersWP < 1.2.67.
- Is there a fix for CVE-2026-13690?
- A patch was published on 2026-07-08: Fixed in version 1.2.67 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-13690 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-13690?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
An authentication bypass vulnerability exists in the UsersWP plugin for WordPress due to improper validation within the two-factor authentication (2FA) login handler. The root cause is the plugin's failure to verify the selected authentication provider during the 2FA challenge phase. An attacker who has already obtained valid primary credentials (username and password) can exploit this by manipulating the login request to bypass the 2FA requirement entirely. This allows for unauthorized account takeover of users who have 2FA enabled. The issue is resolved in version 1.2.67.
Affected products
- UsersWP UsersWP < 1.2.67
Timeline
- 2026-07-08: disclosed
- 2026-07-08: patched: Fixed in version 1.2.67
- 2026-07-29: advisory