CVE-2026-88827: Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

Q: Which authentication methods can still be used by a disabled account?

A disabled account can continue authenticating through XML-RPC and WordPress Application Passwords. The account retains its full existing privileges when using those paths.

Q: Who must an attacker be to exploit this issue?

The attacker must possess credentials or an Application Password for an account that an administrator has disabled. The issue does not describe unauthenticated exploitation.

Q: Are accounts disabled through this plugin fully blocked from access?

No. Through version 1.0.5, the plugin's disabling control is not enforced on all authentication paths, specifically XML-RPC and Application Passwords.

Published Oct 11, 2026

Updated

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.

Affected Software

1 affected component

WordPress Disable Users<=1.0.5

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Which authentication methods can still be used by a disabled account?

A disabled account can continue authenticating through XML-RPC and WordPress Application Passwords. The account retains its full existing privileges when using those paths.

Who must an attacker be to exploit this issue?

The attacker must possess credentials or an Application Password for an account that an administrator has disabled. The issue does not describe unauthenticated exploitation.

Are accounts disabled through this plugin fully blocked from access?

No. Through version 1.0.5, the plugin's disabling control is not enforced on all authentication paths, specifically XML-RPC and Application Passwords.

CVE-2026-88827: Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

Affected Software

Event History

Frequently Asked Questions

Which authentication methods can still be used by a disabled account?

Who must an attacker be to exploit this issue?

Are accounts disabled through this plugin fully blocked from access?

Company

Resources

Contact

Frequently Asked Questions

Which authentication methods can still be used by a disabled account?

Who must an attacker be to exploit this issue?

Are accounts disabled through this plugin fully blocked from access?