Userplace WordPress Plugin Privilege Escalation Vulnerability

The Userplace WordPress plugin through 1.2.0 contains a missing authorization vulnerability in an AJAX action.

This action is available to unauthenticated users, and the nonce protecting it is publicly exposed. As a result, unauthenticated attackers can exploit this flaw.

• Affected versions: through 1.2.0
• Impact: create an administrator account or write arbitrary site options
• Consequence: full site takeover