CVE-2026-13690 Overview
CVE-2026-13690 is an authentication bypass vulnerability in the UsersWP WordPress plugin before version 1.2.67. The plugin's two-factor login handler fails to validate the selected authentication provider. An attacker who already possesses a user's primary credentials can bypass the second authentication factor and log in as that user. The flaw is categorized under [CWE-287] Improper Authentication and carries a CVSS 3.1 base score of 7.4.
Critical Impact
Attackers with valid credentials can bypass two-factor authentication in UsersWP and take over any account, including administrator accounts, defeating the plugin's added identity assurance.
Affected Products
- UsersWP WordPress plugin versions prior to 1.2.67
- WordPress sites with UsersWP two-factor authentication enabled
- Any user account protected by UsersWP 2FA, including administrators
Discovery Timeline
- 2026-07-29 - CVE-2026-13690 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-13690
Vulnerability Analysis
UsersWP provides multi-factor login flows that route users through an authentication provider after primary credential validation. The two-factor login handler accepts a provider identifier from client-supplied input and processes the second-factor challenge based on that value. Because the handler does not verify that the selected provider matches the provider assigned to the user account, an attacker can steer the flow toward a provider path that returns success without a valid second factor.
The vulnerability requires prior knowledge of the victim's username and password. Attack complexity is elevated because the attacker must already control valid credentials, typically obtained through phishing, credential stuffing, or a prior breach. Once inside the second-factor step, the bypass grants full account access with no user interaction required.
Successful exploitation results in a complete session under the target account, exposing site administration, personal data, and any privileged operations the user can perform.
Root Cause
The root cause is missing server-side validation of the authentication provider parameter in the 2FA handler. The plugin trusts a client-controlled selector to determine which verification routine executes, without binding that selector to the authenticated user's configured provider. This is a classic [CWE-287] improper authentication defect where a control-flow decision replaces a cryptographic or session-bound check.
Attack Vector
Exploitation occurs over the network against the WordPress login endpoint. The attacker submits valid primary credentials, reaches the 2FA challenge, and manipulates the provider selection field in the follow-up request to reach a code path that authenticates the session without validating a one-time code. See the WPScan Vulnerability Report for advisory details.
No public proof-of-concept code is referenced in the advisory. The vulnerability is described in prose only; refer to the WPScan advisory linked above for technical specifics.
Detection Methods for CVE-2026-13690
Indicators of Compromise
- Successful WordPress logins recorded without a corresponding 2FA challenge completion event in UsersWP logs.
- Unexpected authentication provider values in POST requests to the UsersWP login handler that do not match the user's configured provider.
- Administrator or privileged account sessions originating from IP addresses or user agents inconsistent with prior baseline activity.
Detection Strategies
- Inspect web server access logs for two-factor login requests containing manipulated provider parameters or repeated attempts against the 2FA endpoint.
- Correlate WordPress wp_login events with UsersWP 2FA completion records; flag logins missing the second-factor step.
- Monitor for credential stuffing patterns preceding successful logins, since exploitation requires valid primary credentials.
Monitoring Recommendations
- Enable verbose authentication logging in WordPress and forward events to a centralized SIEM for correlation.
- Alert on privilege changes, plugin edits, and new administrator account creation events following any suspicious login.
- Track the installed version of UsersWP across managed WordPress sites and alert when versions below 1.2.67 are detected.
How to Mitigate CVE-2026-13690
Immediate Actions Required
- Upgrade UsersWP to version 1.2.67 or later on all WordPress installations.
- Force a password reset for all users protected by UsersWP 2FA, especially administrators.
- Invalidate active WordPress sessions to terminate any attacker-established access.
- Review recent administrator activity, plugin installations, and file modifications for signs of compromise.
Patch Information
The vendor addressed CVE-2026-13690 in UsersWP 1.2.67. The fix validates that the authentication provider submitted in the 2FA request matches the provider configured for the authenticating user. Update through the WordPress plugin dashboard or by replacing the plugin files with the patched release. See the WPScan Vulnerability Report for advisory metadata.
Workarounds
- Temporarily disable the UsersWP plugin on sites where immediate patching is not possible.
- Restrict access to /wp-login.php and UsersWP login endpoints using IP allowlisting or a web application firewall rule.
- Enforce strong, unique passwords and monitor for credential stuffing to reduce the pool of attackers with valid primary credentials.
# Update UsersWP via WP-CLI to the patched release
wp plugin update userswp --version=1.2.67
wp plugin get userswp --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
