{"id":"CVE-2026-13690","aliases":["EUVD-2026-50117","GHSA-gpf8-hm73-g5qv"],"status":"published","title":"UsersWP \u003c 1.2.67 - Two-Factor Authentication Bypass","description":"The UsersWP  WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00411,"percentile":0.35683,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-287"],"published":"2026-07-29T06:00:02Z","modified":"2026-07-30T14:16:31Z","products":[{"vendor":"stiofan","product":"userswp"},{"vendor":"unknown","product":"userswp"}],"references":[{"url":"https://wpscan.com/vulnerability/144202a9-e86f-4977-a97a-eca673859c81/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13690"},{"url":"https://wpscan.com/vulnerability/144202a9-e86f-4977-a97a-eca673859c81"},{"url":"https://github.com/advisories/GHSA-gpf8-hm73-g5qv"}],"sources":{"cve":[{"id":"CVE-2026-13690","title":"UsersWP \u003c 1.2.67 - Two-Factor Authentication Bypass","description":"The UsersWP  WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.","status":"published","published":"2026-07-29T06:00:02.637Z","modified":"2026-07-29T12:38:26.923Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-50117","description":"The UsersWP  WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.","status":"published","published":"2026-07-29T06:00:02Z","modified":"2026-07-29T12:38:26Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T18:02:30.152277Z"}],"ghsa":[{"id":"GHSA-gpf8-hm73-g5qv","title":"The UsersWP  WordPress plugin before 1.2.67 does not validate the selected authentication...","description":"The UsersWP  WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.","status":"published","published":"2026-07-29T09:31:26Z","modified":"2026-07-29T15:31:10Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:09:54.335538Z"}],"nvd":[{"id":"CVE-2026-13690","description":"The UsersWP  WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.","status":"published","published":"2026-07-29T07:16:41.46Z","modified":"2026-07-30T14:16:31.463Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:33.629616Z"}]}}