CVE-2026-112823

Deferred Deferred - Pending Action

Missing Authorization in WP User Manager

Publication date: 2026-10-20

Last updated on: 2026-10-21

Assigner: Patchstack

Description

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-20

Last Modified

2026-10-21

Generated

2026-11-10

AI Q&A

2026-10-20

EPSS Evaluated

2026-11-08

NVD

CVE-2026-112823

EUVD

EUVD-2026-105142

Affected Vendors & Products

Vendor	Product	Version / Range
WP User Manager	WP User Manager	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-862	The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

Executive Summary

This is a Missing Authorization vulnerability in the WP User Manager plugin for WordPress. It allows attackers to manipulate user states without proper authorization checks. The flaw exists in versions up to 2.9.25.

Impact Analysis

An attacker could potentially change user roles or states without permission, leading to unauthorized access or privilege escalation. This may allow them to take control of user accounts or perform actions they shouldn't be able to.

Compliance Impact

The vulnerability allows manipulation of user state due to missing authorization, which could lead to unauthorized access or changes to user data. This may violate GDPR principles like data integrity and confidentiality, and HIPAA requirements for access controls and protected health information security.

Mitigation Strategies

Update WP User Manager to the latest version to address the missing authorization vulnerability. If an update is not available, consider disabling the plugin temporarily until a patch is released.

Hi! I’m here to help you understand CVE-2026-112823. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...