CVE-2026-18352: User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachmenturltopostid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachmentid parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress User Access Manager pluginto a version that resolves this vulnerability.Fixed in 2.3.15Patch User Access Manager <= 2.3.15 - Unauthenticated Arbitrary File Read via 'uamgetfile' Parameter - Configuration
Fix or configure the plugin to no longer accept/process the 'uamgetfile' parameter in a way that leads to directory traversal and unauthorized file streaming.
WordPress User Access Manager plugin uamgetfile parameter = disallow/ignore
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18352?
The severity of CVE-2026-18352 is high, rated at 7.5 on the CVSS scale.
What type of vulnerability is CVE-2026-18352?
CVE-2026-18352 is a directory traversal vulnerability allowing unauthenticated arbitrary file read.
How can I fix CVE-2026-18352?
To fix CVE-2026-18352, update the User Access Manager plugin to version 2.3.16 or later.
Who is affected by CVE-2026-18352?
All users of the User Access Manager plugin for WordPress versions up to and including 2.3.15 are affected by CVE-2026-18352.
What can attackers do with CVE-2026-18352?
Attackers can exploit CVE-2026-18352 to read sensitive contents of arbitrary files on the server.