Vulnerability · Published Jul 29, 2026 · Assigned by WPScan
CVE-2026-13690UsersWP < 1.2.67 - Two-Factor Authentication Bypass
High 7.4
In plain English
A high-severity improper authentication in UsersWP from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).
Severity (CVSS 3.1)7.4High
Exploit odds (30 days)0.4%top 64.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.
Affected products (as reported)
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
References
- https://wpscan.com/vulnerability/144202a9-e86f-4977-a97a-eca673859c81/ exploit, vdb-entry, technical-description