Description

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-08-12T06:19:22.667Z",
  "pubdate": "2026-08-12T06:19:22.667Z",
  "executiveSummary": "An access control bypass vulnerability exists in the User Access Manager WordPress plugin prior to version 2.3.15.\nThe flaw allows unauthenticated remote attackers to bypass defined security restrictions and read the content of posts, pages, and custom post types that are intended to be restricted exclusively to specific user groups.\nThe vulnerability directly impacts confidentiality by exposing sensitive or protected site content to unauthorized entities via the WordPress REST API endpoint.\nUnauthenticated attackers can leverage this security deficiency without possessing any prior privileges or interactive user accounts on the target WordPress installation.\nThe root cause stems from the application's failure to enforce authorization checks during REST API context processing, rendering traditional group-based content restrictions ineffective for programmatic requests.\nImmediate remediation requires updating the User Access Manager plugin to version 2.3.15 or later to ensure proper integration of access control enforcement mechanisms across all request channels.",
  "technicalDetails": "The vulnerability resides within the User Access Manager WordPress plugin, specifically affecting how access restrictions are evaluated and enforced across different application request flows.\nThe root cause of the flaw is the absence of access control logic integration within the WordPress REST API handling routines of the plugin.\nWhile traditional HTTP requests processed through standard WordPress routing correctly evaluate user group memberships and apply visibility limitations to posts, pages, and custom post types, requests handled via the REST API bypass these validation checks entirely.\nBecause the REST API architecture operates independently of standard theme and page rendering hooks where the plugin typically injects its filtering logic, the protected objects are serialized and returned in responses without verifying whether the requesting session belongs to an authorized user group.\nAn unauthenticated attacker can exploit this vulnerability by sending HTTP GET or POST requests directly to the exposed WordPress REST API endpoints corresponding to posts, pages, or custom post types.\nThe attack flow proceeds as follows: 1) The attacker enumerates or targets specific REST API routes; 2) The attacker transmits an unauthenticated HTTP request to the endpoint; 3) The WordPress REST API controller queries the database and retrieves the requested post objects; 4) Due to the lack of enforcement by the User Access Manager plugin within the REST API context, the authorization filter is omitted; 5) The server serializes the restricted content into JSON format and returns it in the HTTP response body.\nThe affected component is the access restriction enforcement module of the User Access Manager plugin across versions prior to 2.3.15.\nExploitation requires network exposure to the WordPress REST API interface, requires no authentication, and demands zero privileges.\nThe post-exploitation impact is limited to a loss of confidentiality regarding restricted posts, pages, and custom post types, potentially exposing sensitive internal data intended only for restricted user groups."
}