CVE-2026-108496: WordPress WP User Manager plugin <= 2.9.23 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wp-user-manager/wp-user-managerto a version that resolves this vulnerability.Fixed in 2.9.24
Event History
Frequently Asked Questions
Which installations are affected?
Installations using WP User Manager versions through 2.9.23 are affected. The available information does not identify a lower affected version boundary.
Does exploitation require authentication or user interaction?
No. The CVSS vector indicates that exploitation is network-accessible, requires no privileges, and requires no user interaction.
What impact is indicated by the available severity data?
The CVSS vector indicates low confidentiality impact, with no integrity or availability impact. The issue is rated medium severity with a CVSS score of 5.3.