WP User Manager: Missing authorization
A low-privilege authenticated attacker can reach functionality without the required authorization. The CNA vector indicates limited integrity through manipulation of user state impact. The export does not disclose the endpoint, action, parameter, function, protected resource or exact operation, nor the specific WordPress role. No more specific exploit mechanics are inferred. Affected versions: at most 2.9.25. The completed CNA record identifies 2.9.26 as fixed.
- Component
- WP User Manager
- Plugin slug
wp-user-manager- Affected
- <= 2.9.25
- Safe version
2.9.26- Published
- Oct 20, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Oct 20, 2026 and is one of 17 known issues for this plugin.
Update, patch or deactivate.
The authoritative export identifies 2.9.26 as fixed. Update to the applicable fixed release or a later supported release. Enforce authorization for the requested operation and target object before returning protected data or making changes; do not rely on client-supplied identifiers or request metadata as proof of permission.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N