CVE-2026-124413: WordPress WP User Manager plugin <= 2.10.4 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP User Manager (wp-user-manager)to a version that resolves this vulnerability.Fixed in 2.10.5
Event History
Frequently Asked Questions
Who can exploit this issue?
The CVSS vector indicates that exploitation can be performed remotely with low attack complexity, without privileges or user interaction.
What is the likely security impact?
The reported impact is limited to confidentiality. The CVSS vector indicates low confidentiality impact and no integrity or availability impact.
Which plugin versions are affected?
WP User Manager versions through 2.10.4 are affected. The available data does not identify a fixed version.