UsersWP provider selection permits two-factor authentication bypass
UsersWP before 1.2.67 lets an attacker who already knows a protected user's username and password bypass that user's second factor. After the password stage supplies a user-specific uwp-auth-id and wp-auth-nonce, the unauthenticated admin-ajax action uwp_ajax_login_process_2fa reaches Forms::process_login_2fa(). The handler accepts the attacker-controlled provider parameter but, before 1.2.67, validates a second factor only when its value exactly matches totp, email or backup_codes. Any other provider value skips every validation branch, after which the handler deletes the login nonce, calls wp_set_auth_cookie() for the selected user and reports successful authentication. The linked WPScan advisory withholds its request proof of concept until August 8, 2026, but the official 1.2.66/1.2.67 source diff discloses this data path.
- Component
- UsersWP
- Plugin slug
userswp- Affected
- < 1.2.67
- Safe version
1.2.67- Published
- Jul 29, 2026
This CVE was published Jul 29, 2026 and is one of 17 known issues for this plugin.
Update, patch or deactivate.
Update UsersWP to 1.2.67 or later. Version 1.2.67 verifies that the submitted provider is enabled for the user's role and rejects an invalid provider before creating an authentication cookie. Treat credentials for accounts protected by WP 2FA as compromised if unexplained logins occurred through a vulnerable UsersWP login form, and rotate those credentials and active sessions.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.
CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N