CVE-2026-107423: WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability
Published Oct 12, 2026
·Updated
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22.
Affected Software
1 affected component
WP User Manager WP User Manager<=2.9.22
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP User Managerto a version that resolves this vulnerability.Fixed in 2.9.23
Event History
Oct 12, 2026
CVE Published
via MITRE·08:26 AM
Data Sourced
via MITRE·08:26 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·09:16 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an existing account?
Yes. The attack vector requires low privileges, so an attacker needs an account with limited permissions.
2
Can this be exploited remotely without victim interaction?
Yes. The vulnerability is network-accessible and does not require user interaction.
3
How can I identify potentially affected installations?
WP User Manager versions through 2.9.22 are affected. The provided information does not identify a fixed version.