Auth bypass in Userswp
CVE-2026-13690
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and…
Vulnerability class: Broken Authentication
CVSS v3 metric
CVSS v3 base score 7.4 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N.
Affected products
- Unknown Userswp — versions 0
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-13690?
- CVE-2026-13690 is a high-severity vulnerability in Userswp, classified under Improper Authentication. CVSS score: 7.4/10. Published 2026-07-29.
- How severe is CVE-2026-13690?
- High severity. CVSS v3 base score is 7.4 out of 10.