https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T20:35:40.856699+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-16259 fkie_cve-2026-16259 2026-09-29T20:35:40.861366+00:00

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.

 https://vulnerability.circl.lu/vuln/ghsa-p38m-pp69-pr2w GHSA-p38m-pp69-pr2w 2026-09-29T20:35:40.861462+00:00

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.