https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 20:35:39 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-16259 <p>The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator&#39;s email and password, and take over the account.</p> <p>The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator&#39;s email and password, and take over the account.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-16259 https://vulnerability.circl.lu/vuln/ghsa-p38m-pp69-pr2w <p>The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator&#39;s email and password, and take over the account.</p> <p>The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator&#39;s email and password, and take over the account.</p> https://vulnerability.circl.lu/vuln/ghsa-p38m-pp69-pr2w