CVE-2026-13690

The UsersWP plugin for WordPress prior to version 1.2.67 is vulnerable due to inadequate validation of the authentication provider in its two-factor login handler. This flaw allows attackers with knowledge of a user's credentials to bypass the second authentication factor, potentially leading to unauthorized access. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate the risk of account compromise.