Userplace Plugin Exposes Nonce, Enables Unauthenticated Admin Creation

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Userplace WordPress plugin through version 1.2.0 contains a critical authorization bypass vulnerability in its AJAX endpoints. The plugin fails to verify user authentication before processing sensitive actions and publicly exposes the security nonce that should protect these endpoints, allowing unauthenticated attackers to create administrator accounts or modify arbitrary site options. This vulnerability affects any WordPress installation running the vulnerable plugin version, potentially impacting thousands of sites. The CVSS 9.8 critical rating reflects the severity: attackers can achieve complete site takeover without any credentials or authentication, making this a high-priority threat requiring immediate patching.

Casky's 224 mapped skills detect this attack pattern by analyzing Privilege Escalation (TA0004) techniques through Claude's extended reasoning capabilities. A practitioner monitoring their environment would observe: (1) unauthenticated AJAX requests to Userplace endpoints containing valid nonces, (2) HTTP POST requests creating new WordPress user accounts with administrator roles from unexpected sources, (3) wp_options table modifications via unauthenticated requests, and (4) suspicious admin account creation events with no corresponding user registration activities. Casky's skill mapping identifies the authorization check bypass (CWE-269) as the root cause and correlates it with post-exploitation indicators like new privileged accounts and configuration changes, enabling practitioners to detect both active exploitation attempts and post-compromise artifacts before full site takeover occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110963.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-110963

Casky has 224 skills that investigate the attack patterns behind CVE-2026-110963. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn