Security Alert Summary
The Uix UserCenter WordPress plugin through 1.0.3 contains an authentication and authorization vulnerability that allows unauthenticated attackers to forge tokens and perform a profile-update action for any user. An attacker can overwrite an administrator’s email and password and take over the account.
CVE Details
- CVE ID:
CVE-2026-16259 - Affected component: Uix UserCenter WordPress plugin
- Affected versions: versions up to and including 1.0.3
- Published: August 29, 2026 at 6:17 AM
- Last modified: August 29, 2026 at 6:17 AM
- CVSS v3.1: Not provided in the CVE record
- Authentication requirements: None – the issue can be triggered by unauthenticated attackers
- Privileges required: None
- User interaction: None required
- Primary impact:
- Confidentiality: Potential access to account details and email addresses associated with user accounts
- Integrity: Ability to overwrite user email and password, enabling account takeover
- Availability: Not indicated as affected by this vulnerability
- CWE / weakness ID: Not provided in the CVE record
Technical Details
The plugin’s profile-update action does not verify that the account being modified belongs to the requester. The action is authenticated using a token whose signing key is hardcoded and identical across every install. Because the signing key is predictable and the profile-update request lacks proper ownership checks, an unauthenticated attacker can forge a valid token for any user and submit a profile-update that modifies that user’s email and password.
The direct consequence of these flaws is an account takeover: an attacker who forges a token can change credentials for administrator-level accounts and gain persistent access. The description does not name specific functions or REST endpoints beyond the profile-update action, and no CVSS vector strings or CWE identifiers are provided in the CVE record.
How This Could Impact Your Website
Consider a small WordPress site with a site owner, a couple of internal staff editors, and an external contractor who contributes content. If the site uses an affected version of the Uix UserCenter plugin, an unauthenticated attacker could target an administrator account and overwrite the admin email and password. This can lead to unauthorized account access, disclosure of internal user email addresses, and an increased risk of targeted phishing or social engineering against staff or contractors.
If you're unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and editor accounts.
- Enforce strong, unique passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual behavior, such as unexpected password or email changes.
If you'd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
