What is CVE-2026-13690?
CVE-2026-13690 affects the UsersWP WordPress plugin before version 1.2.67, where a lack of validation of the selected authentication provider in the two-factor login handler allows an attacker with valid credentials to bypass the second authentication factor and gain unauthorized access to user accounts. Immediate update to version 1.2.67 or later is recommended to mitigate this vulnerability.
Azərbaycanca: CVE-2026-13690, UsersWP WordPress plaginində (1.2.67-dən əvvəlki versiyalarda) iki faktorlu autentifikasiya prosesində autentifikasiya təminatçısının düzgün yoxlanılmamasına görə, istifadəçi məlumatlarını bilən hücumçu ikinci təhlükəsizlik qatını keçərək hesaba daxil ola bilər. Bu boşluq istifadəçi hesablarının oğurlanması riski yaradır. Plagini dərhal 1.2.67 və ya daha yeni versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-306
FAQ2
Which versions of the UsersWP plugin are vulnerable to CVE-2026-13690?
Versions of the UsersWP plugin prior to 1.2.67 are affected by this vulnerability.
How can an attacker exploit CVE-2026-13690 to gain unauthorized access to accounts?
An attacker with valid user credentials can bypass the second authentication factor and gain unauthorized access due to a lack of validation of the selected authentication provider in the two-factor login handler.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.