UNKNOWN NVD

CVE-2026-16259

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to th

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.

References

https://wpscan.com/vulnerability/e551128c-c9b1-4e6a-a2aa-92830b7a4887/

Published: 2026-08-29 · Source: NVD · Feed updated: 2026-08-29

This unknown severity vulnerability was published on 2026-08-29 via NVD.

vulnfeed aggregates 11507 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.