WP User Manager CVE-2026-103085

Requires a target running the WP User Manager plugin for WordPress at any version up to and including 2.9.20. Exploitation abuses an improper access-control check (CWE-284) in the plugin's user-management functionality to reach privileges or actions the requester is not authorized for. The CVSS vector states no privileges and no user interaction (PR:N/UI:N), implying default-configuration, remote reachability; however, the 'privilege escalation' classification in the Patchstack reference suggests a pre-existing low-privileged WordPress account may in practice be the real prerequisite - this limiting factor should be confirmed with the vendor advisory. No non-default configuration is named in the available data.

This is a medium-severity (CVSS 6.5) improper access control flaw (CWE-284) in the WP User Manager WordPress plugin, reported by Patchstack. The provided CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates a remotely reachable, low-complexity, unauthenticated issue with limited confidentiality and integrity impact (C:L/I:L) and no availability impact. No EPSS score was supplied, the CVE is NOT listed in CISA KEV, and no public proof-of-concept is referenced, so there is no public exploit identified at time of analysis. Note a tension in the data: the CVSS vector asserts PR:N (unauthenticated) and only Low impact, yet the Patchstack reference title and classification describe 'privilege escalation,' which typically presupposes an already-authenticated low-privileged account escalating rights - this would imply PR:L rather than PR:N. This discrepancy should be verified against the Patchstack advisory, as it materially changes who can exploit the flaw. Overall this is a moderate-priority patching item for WP User Manager operators rather than an emergency: real-world risk is tempered by the absence of KEV/POC/EPSS signals and the Low-only impact scoping, but the unauthenticated network vector (if confirmed) raises its practical exposure.

A remote attacker interacts with a WordPress site running WP User Manager ≤ 2.9.20 and abuses missing or improper access-control checks to perform actions or reach a privilege level they should not have. Given the Low-complexity network vector, the request can be sent directly against the plugin's exposed functionality; however, the 'privilege escalation' framing suggests the attacker may first need a low-privileged account. No public exploit code is identified at time of analysis.