A critical authentication bypass vulnerability in the Uix UserCenter WordPress plugin allows unauthenticated attackers to achieve full account takeover.

The plugin fails to perform proper authorization checks during profile updates and relies on a hardcoded, globally identical signing key for authentication tokens. This allows unauthenticated attackers to forge tokens, modify account details, and escalate privileges to administrative levels.

The ability for unauthenticated attackers to modify any user account, including administrators, represents a total compromise of the application integrity. Given the CVSS score of 9.8, this flaw poses a severe risk of complete data theft, unauthorized system access, and persistent backdoor installation within the WordPress environment.

Immediate Action: Since a specific patch version is not currently identified, administrators should immediately deactivate and remove the Uix UserCenter plugin until the vendor provides a secure update.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at profile update endpoints, specifically looking for unusual patterns or unrecognized user modifications.

Compensating Controls: Deploy a Web Application Firewall (WAF) to block unauthorized requests attempting to access profile update functions or patterns indicative of token forgery.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability is critical due to the ease of exploitation and the total impact on application security. Organizations using the Uix UserCenter plugin must prioritize the immediate removal or disabling of this component to prevent unauthorized administrative account takeovers, as no current patch is confirmed to exist.