Description

The Uix UserCenter WordPress plugin through 1.0.3 does not verify that the account being modified through an unauthenticated profile-update action belongs to the requester, and it authenticates that action with a token whose signing key is hardcoded and identical across every install, allowing unauthenticated attackers to forge a token for any user, overwrite an administrator's email and password, and take over the account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-29T06:17:00.360Z",
  "pubdate": "2026-08-29T06:17:00.360Z",
  "executiveSummary": "The Uix UserCenter WordPress plugin, in versions up to 1.0.3, contains a critical authentication bypass vulnerability stemming from the use of a hardcoded signing key for token verification. This flaw facilitates an unauthenticated Account Takeover (ATO) attack by allowing attackers to forge valid authentication tokens for arbitrary user accounts, including those with administrative privileges. Because the signing key is static and identical across all global installations, an attacker can bypass the intended authorization logic of the profile-update action. The impact is severe, as it permits an unauthenticated actor to modify sensitive account credentials, specifically email addresses and passwords, leading to a complete compromise of the target WordPress instance. This vulnerability is classified as critical due to the ease of exploitation, requiring no prior user authentication or specific victim interaction, and the high impact of administrative takeover.",
  "technicalDetails": "The vulnerability resides within the profile-update mechanism of the Uix UserCenter WordPress plugin. The root cause is two-fold: an insecure authorization check and the reliance on a hardcoded, static cryptographic signing key used to validate authentication tokens. During the profile-update process, the plugin fails to perform a server-side verification to ensure that the user requesting the profile modification is the legitimate owner of the target account. Instead, the application relies on an authentication token that the client provides to authorize the update action.\nThe implementation uses a static, hardcoded secret key to sign these tokens, which is consistent across every instance of the plugin. Because the signing key is embedded directly within the plugin's codebase, an attacker can extract it through static analysis. Once the key is obtained, the attacker can use it to sign malicious tokens that masquerade as any user, including high-privileged administrator accounts.\nThe exploitation flow is as follows: First, the attacker identifies a target user ID (UID) or username within the target WordPress environment. Second, the attacker generates a forged JSON Web Token (JWT) or equivalent structure using the recovered hardcoded signing key, crafting the payload to specify the target UID as the authenticated identity. Third, the attacker initiates an unauthenticated request to the profile-update endpoint, appending the forged token. The plugin’s backend logic decodes the token, validates the signature against the hardcoded secret, and—due to the lack of proper ownership verification—trusts the token as valid for the specified UID.\nUpon successful validation, the backend allows the attacker to execute arbitrary changes to the target profile, such as modifying the associated email address and password. By altering the administrative email to an address under their control, the attacker can initiate a password reset, effectively locking out the legitimate administrator and gaining full control of the web application. The vulnerability affects all versions of Uix UserCenter up to and including 1.0.3. The attack vector is purely network-based, requires no special privileges, and bypasses standard authentication controls, posing an immediate and total risk to the confidentiality, integrity, and availability of the affected WordPress site."
}