CVE-2026-16259

CVE-2026-16259 is a broken-access-control flaw (CWE-269) in the Uix UserCenter WordPress plugin through version 1.0.3: an unauthenticated profile-update action never verifies that the account being modified belongs to the requester. The action is authenticated only by a token signed with a hardcoded signing key that is identical on every installation, so an attacker can craft a valid token naming any user on any site running the plugin. By presenting such a forged token to the profile-update action, an attacker can overwrite an administrator's email address and password and take over that account, which for an administrator effectively means full control of the WordPress site. Any WordPress site with Uix UserCenter 1.0.3 or earlier active is affected; exposure is limited to sites running this niche front-end account-management plugin. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is currently known, and EPSS assigns a low 0.3% probability of exploitation within 30 days.

What to do: Upgrade the Uix UserCenter plugin to a release newer than 1.0.3 as soon as a patched version is published (no fixed version number is documented in the available data), or deactivate/remove the plugin in the meantime as the only immediate mitigation, since the hardcoded signing key cannot be reconfigured per site. After patching, verify that administrator accounts have not been tampered with — check for unexpected email address or password changes — and reset admin credentials if anything looks modified.