Description

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-12T09:16:41.917Z",
  "pubdate": "2026-10-12T09:16:41.917Z",
  "executiveSummary": "The WP User Manager plugin, spanning versions n/a through 2.9.22, contains a critical Missing Authorization vulnerability.\nThis security flaw stems from improperly configured access control security levels, allowing unauthorized users to perform actions restricted to higher privilege levels.\nThe vulnerability exposes the application to unauthorized state changes or data manipulation, potentially leading to a full compromise of user account management functionality.\nAn attacker can exploit this flaw without possessing elevated administrative credentials, provided they have network access to the affected WordPress instance.\nThe risk implication is high, as the vulnerability facilitates unauthorized access to sensitive administrative or user-specific operations, bypassing intended security boundaries within the plugin's architecture.",
  "technicalDetails": "The vulnerability originates from a deficiency in the access control mechanism within the WP User Manager plugin's request handling logic. The root cause is the failure to properly validate user authorization states before executing sensitive functions or accessing restricted endpoints.\nSpecifically, the plugin fails to perform rigorous capability checks (e.g., WordPress 'current_user_can()' checks) on operations that alter system configurations or handle sensitive user data. Because the access control security levels are incorrectly configured, the plugin's API or controller functions implicitly trust incoming requests without verifying if the requesting user possesses the requisite administrative privileges.\nThe attack flow begins with an unauthenticated or low-privileged user identifying an exposed administrative endpoint or function associated with the plugin. By crafting a specifically formatted HTTP request, the attacker can invoke functions that were intended only for site administrators. The application processes the request under the assumption that the authorization has already been verified, thereby granting the attacker access to privileged operational workflows.\nBecause the plugin lacks consistent authentication and authorization enforcement across its functional modules, this missing check affects multiple components responsible for user profile management or settings modification. The vulnerability is exploitable over the network, and the attacker does not require prior knowledge of legitimate administrator sessions.\nThe post-exploitation impact includes the potential to modify plugin settings, alter user account roles, or access restricted administrative interfaces. This could lead to further escalation of privileges within the WordPress environment, potentially allowing the attacker to inject malicious code or exfiltrate protected user information. The absence of strict authorization checks across the affected versions (n/a through 2.9.22) creates a persistent state where unauthorized actors can manipulate the plugin's internal state, effectively bypassing the security model of the WP User Manager plugin."
}