The Uix UserCenter WordPress plugin, when installed in version 1.0.3 or earlier, fails to verify that a profile‑update request is being made for the authenticated user itself. Coupled with a hardcoded signing key that is identical on every installation, an attacker can generate a valid authentication token for any user account. By sending an unauthenticated request that carries this forged token, the attacker can overwrite an administrator’s email address and password, effectively taking control of the administrator account and gaining full administrative privileges on the WordPress site.

All WordPress sites that have the Uix UserCenter plugin at version 1.0.3 or earlier are affected. The vulnerability is inherent to the plugin code and does not depend on other components of the host environment. Sites that have not upgraded beyond 1.0.3 are at risk of account takeover for any registered user, including administrators.

The exploit requires only the ability to set an HTTP request to the profile‑update endpoint and to create a forged token; there is no prerequisite authentication. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog, yet the impact of isolating a site administrator is high. The likely attack vector is from a remote unauthenticated attacker sending a crafted HTTP request with a forged token. The risk remains high until the plugin is upgraded to a patched version that validates account ownership and uses unique, securely generated signing keys.