CVE-2026-13690: unknown userswp Improper Authentication
Vulnerability summary
CVE-2026-13690 is a high (CVSS 7.4) Improper Authentication vulnerability in unknown userswp. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 34.1% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 1.2.67.
Timeline
- 29-07-2026PublishedVulnerability first disclosed.
- 29-07-2026Last modifiedVulnerability information updated.
Description
The UsersWP WordPress plugin before 1.2.67 does not validate the selected authentication provider in its two-factor login handler, allowing an attacker who already knows a user's credentials to bypass the second authentication factor and log in as that user.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST7.4HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
- wordfenceSource5.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NDiffers
EPSS trend
Probability
0.41%
Chance of exploitation in the next 30 days
Percentile
34%
Versus all other CVEs
30-day change
+0.16 pp
From 0.25% on 21-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
- CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.
Affected systems
Unknown1 product
- userswp< 1.2.67
Wordpress1 product
- userswp< 1.2.67
2 vendors · 2 products