CVE-2026-116846: WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP User Manager (wp-user-manager)to a version that resolves this vulnerability.Fixed in 2.10.0
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The available CVSS vector indicates that exploitation is network-accessible, requires low attack complexity, does not require privileges, and does not require user interaction.
Which installations should be considered affected?
WP User Manager versions through 2.9.26 are identified as affected. The supplied data does not identify a fixed version or any configuration conditions that limit exposure.
What is the known impact if exploitation succeeds?
The issue is rated medium severity with a 5.3 CVSS score. The vector indicates low confidentiality impact and no identified integrity or availability impact.