Summary
CVE-2026-86814 is an authentication bypass vulnerability in the UsersWP WordPress plugin, caused by improper privilege management (CWE-269) in its social login feature. Because the plugin does not verify that a social login provider has actually confirmed ownership of an email address before using that email to resolve an existing WordPress account, an unauthenticated attacker can log in as any user — including administrators — by asserting an email address through a social provider account they control. The issue carries a High severity rating (CVSS 8.1) and affects all UsersWP versions prior to 1.5.10.
Technical details
- Root cause: UsersWP’s social login flow trusts the email address returned by a third-party social login provider and uses it to match and log the visitor into an existing WordPress account, without confirming the provider has verified that email address belongs to the person authenticating.
- Trigger condition: An attacker registers or authenticates with a social login provider using (or asserting) an email address that matches an existing WordPress account on the target site, then completes the social login flow on the vulnerable site.
- Attack vector: Network — exploitable remotely over HTTP(S) against any public-facing WordPress site with UsersWP social login enabled; no prior authentication or victim interaction is required.
- Impact: Full account takeover of any user whose email can be asserted this way, including site administrators, leading to loss of confidentiality, integrity, and availability of the site (as reflected by High/High/High impact ratings).
Affected software
- UsersWP WordPress plugin, all versions prior to 1.5.10 (social login feature).
Severity
- CVSS v3.1 Base Score: 8.1 (High)
- Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Mitigation and recommended actions
- Immediate: Upgrade UsersWP to version 1.5.10 or later, which corrects the email-ownership verification logic in the social login flow.
- If immediate patching is not possible: Disable the UsersWP social login feature until the update can be applied, and audit user accounts/login logs for unexpected administrator or privileged account logins via social login.