The Userplace WordPress plugin through version 1.2.0 lacks proper authorization checks on an AJAX action that is exposed to unauthenticated users, and the nonce protecting that action is publicly visible. An attacker can therefore submit a crafted request that creates a new administrator account or writes arbitrary site options, resulting in full control of the site.

All WordPress sites that have the Userplace plugin installed in version 1.2.0 or earlier are affected, regardless of the core WordPress version. The vulnerability is tied to the plugin’s AJAX endpoint and does not depend on other components of the WordPress installation.

The likely attack vector is an unauthenticated AJAX request that includes the exposed nonce, as the plugin does not perform any authorization checks. Because the flaw allows creation of an administrator account or modification of site options, the impact is full site takeover. The CVSS score is not provided, and the EPSS score is unavailable; however, the absence of a KEV listing does not mitigate the severity of the flaw. Attackers can exploit the vulnerability immediately with minimal effort and no prerequisite credentials.