CVE-2026-13690 in UsersWP Plugin
Summary
by MITRE • 07/29/2026
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The UsersWP WordPress plugin vulnerability represents a critical security flaw in the two-factor authentication implementation that directly undermines the intended protection mechanisms. This issue affects versions prior to 1.2.67 and demonstrates a fundamental failure in input validation within the authentication flow. The vulnerability exists specifically within the two-factor login handler where the system fails to properly validate or sanitize the authentication provider selection, creating an exploitable condition that can be leveraged by authenticated attackers.
The technical implementation flaw stems from inadequate parameter validation within the authentication processing pipeline. When a user attempts to log in with two-factor authentication enabled, the system should verify that the selected authentication provider is legitimate and authorized for use. However, the UsersWP plugin does not perform this crucial validation step, allowing an attacker who has already obtained valid username and password credentials to manipulate the authentication flow by selecting an unauthorized or bypassable authentication method.
This vulnerability creates significant operational impact as it effectively neutralizes the second factor of authentication, which is designed to provide additional security layers beyond traditional username/password combinations. Attackers can exploit this weakness by leveraging their knowledge of valid user credentials to bypass the second authentication factor entirely, potentially gaining unauthorized access to user accounts without proper authorization. The attack vector is particularly concerning because it requires minimal additional information beyond what is already available through credential theft or social engineering.
From a cybersecurity perspective, this vulnerability aligns with CWE-20, which addresses improper input validation issues that can lead to authentication bypass scenarios. The flaw also corresponds to ATT&CK technique T1078.004, which covers legitimate credentials obtained through credential dumping or other means, where the weakness allows attackers to leverage valid credentials to bypass multi-factor authentication controls. Organizations using affected plugin versions face increased risk of unauthorized account access, potential data breaches, and compromise of user privacy.
The recommended mitigation strategy involves immediate upgrade to UsersWP plugin version 1.2.67 or later, which contains the necessary validation fixes for the two-factor authentication handler. Additionally, administrators should implement comprehensive monitoring of authentication events to detect unusual patterns that may indicate exploitation attempts. Network segmentation and additional access controls should be considered as compensating measures while awaiting the patch deployment, particularly in environments where user accounts contain sensitive information or administrative privileges.