What is GHSA-78p4-p67c-wwv7?

GHSA-78p4-p67c-wwv7 is a security advisory published by GitHub Security Advisories with Critical severity. The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX...

Which CVE IDs does GHSA-78p4-p67c-wwv7 cover?

GHSA-78p4-p67c-wwv7 covers the following CVE IDs: CVE-2026-110963. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-78p4-p67c-wwv7?

GHSA-78p4-p67c-wwv7 has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-78p4-p67c-wwv7CriticalCVSS 9.8

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-110963 →

📋 Description

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-110963
https://wpscan.com/vulnerability/c30f71d3-2ec4-4bee-8864-f7c19cf6fcb7
https://github.com/advisories/GHSA-78p4-p67c-wwv7