CVE-2026-18352
Received Received - Intake

Directory Traversal in User Access Manager WordPress Plugin

Publication date: 2026-08-02

Last updated on: 2026-08-02

Assigner: Wordfence

Description
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-02
Last Modified
2026-08-02
Generated
2026-08-02
AI Q&A
2026-08-02
EPSS Evaluated
N/A
NVD
CVE-2026-18352

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wpuxsolutions user_access_manager to 2.3.15 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-22 The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The User Access Manager WordPress plugin up to version 2.3.15 has a Directory Traversal vulnerability via the 'uamgetfile' parameter. Unauthenticated attackers can exploit this to read arbitrary files on the server by manipulating the parameter to bypass access controls. The flaw occurs when the plugin incorrectly processes file paths, allowing access to sensitive data.

Detection Guidance

To detect this vulnerability, check WordPress sites using the User Access Manager plugin versions up to 2.3.15. Look for unusual file access patterns or requests containing the 'uamgetfile' parameter with traversal sequences like '../'. Monitor server logs for unauthorized file read attempts.

Impact Analysis

This vulnerability allows attackers to access sensitive files on your server without authentication. These files may contain confidential data like passwords, configuration files, or other sensitive information, potentially leading to further attacks or data breaches.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face legal penalties, fines, or reputational damage if exploited.

Mitigation Strategies

Immediately update the User Access Manager plugin to the latest version beyond 2.3.15. If an update is unavailable, consider disabling the plugin temporarily. Review server file permissions to restrict unauthorized access and monitor for suspicious activity.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18352. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart