CVE-2026-108496

5.3Medium

Published 13 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

5.3Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-862

Impact

Unauthenticated remote attackers can read restricted user-related data over the network. They need only direct network access to the WordPress site.

Root cause

A missing authorization check fails to enforce access control levels on exposed endpoints.

Affected systems

WP User Manager through 2.9.23

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Fix & remediation

Upgrade the WP User Manager plugin to a version newer than 2.9.23 once released, or deactivate the plugin until patched.

shell

$ wp plugin update wp-user-manager

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23.

References

https://patchstack.com/database/wordpress/plugin/wp-user-manager/vulnerability/wordpress-wp-user-manager-plugin-2-9-23-broken-access-control-vulnerability?_s_id=cve

Source: nvd.nist.gov/vuln/detail/CVE-2026-108496