critical · CVSS v3 9.1

CVE-2026-110963

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauth…

Description

The Userplace WordPress plugin through 1.2.0 does not perform authorization checks on an AJAX action available to unauthenticated users and publicly exposes the nonce that protects it, allowing unauthenticated attackers to create an administrator account or write arbitrary site options, leading to full site takeover.

Scores

Severity
critical
CVSS v2
5
CVSS v3
9.1
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-123595

Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checking the type bitmap and so accepts parent-side ancestor-delegation NSEC3 records as proof of nonexistence. An attacker who delivers one response built from genuinely signed parent NSEC3 records can cause NXDOMAIN or NODATA to be cached with AD=1, denying resolution of existing names at and below the zone cut.

View analysis

critical

CVE-2026-123596

Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of nonexistence for names below the zone cut. An on-path attacker, rogue parent nameserver, or attacker winning a port and TXID race can deliver one forged NXDOMAIN response built from genuinely signed parent NSEC records, causing authenticated denial of existing child-zone names cached for the negative TTL.

View analysis

critical

CVE-2026-123605

Hickory DNS hickory-proto 0.1 through 0.25.0-alpha.3 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because the validator verifies an RRSIG against the DNSKEY of whatever name appears in its Signer's Name field without checking that this name is the zone containing the RRset. Attackers controlling any secure zone can produce valid signatures over arbitrary records in unrelated zones, which resolvers, recursors, and clients using DnssecDnsHandle accept as authenticated.

View analysis

critical

CVE-2026-123614

Imgproxy versions 4.0.0 through 4.0.15 contain an integer overflow in the ICO loader that can be exploited via a crafted data_size value. The flaw leads to a heap buffer overflow, potentially crashing the process or allowing code execution. This vulnerability is critical and can be triggered remotely by submitting a malicious ICO image.

View analysis