What is the CVSS score of CVE-2026-12097?

CVE-2026-12097 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.3%.

User Management CVE-2026-12097

EUVD-2026-42169 MEDIUM

Missing Authorization (CWE-862)

2026-07-08 Wordfence

GHSA-fm3p-77j7-xv3w

Authentication Bypass WordPress User Management

5.3

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network write to plugin option with no confidentiality or availability impact on the direct action; downstream credential exposure is a chained risk, not the base vulnerability's direct impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 08, 2026 - 06:32 vuln.today

CVE Published

Jul 08, 2026 - 05:34 nvd

MEDIUM 5.3

DescriptionCVE.org

The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the plugin's export field configuration stored in the uiewp_export_field option, controlling which user fields such as password hashes are included in CSV exports and how columns are mapped during imports.

AnalysisAI

Authorization bypass in the User Management WordPress plugin (versions ≤ 1.2) permits unauthenticated network attackers to overwrite the plugin's export field configuration stored in the uiewp_export_field WordPress option, determining which user fields - including password hashes - are bundled into CSV exports and how columns are interpreted during user imports. Reported by Wordfence, the flaw stems from CWE-862 (Missing Authorization), meaning the plugin performs no privilege check before accepting these writes. No public exploit code and no CISA KEV listing have been identified at time of analysis; however, the ability to preconfigure exports to surface password hashes represents a meaningful secondary confidentiality risk beyond the raw CVSS 5.3 Medium score.

Technical ContextAI

The vulnerability is classified under CWE-862 (Missing Authorization), a root-cause class where a function that modifies sensitive state is exposed without any access-control gate. The affected code is the User Management plugin for WordPress, authored by saadiqbal, identified by CPE cpe:2.3:a:saadiqbal:user_management:*:*:*:*:*:*:*:* across all versions through 1.2. Source references point to three locations in includes/model.php (lines 21, 729, and 853) and the plugin entry point users-imp-exp-wpexperts.php (line 22), suggesting the unguarded handlers are spread across model-layer functions governing both the export-field registry and the import column-mapping logic. WordPress plugins are expected to use current_user_can() or nonce verification before processing AJAX or REST actions that modify wp_options; the absence of such checks here is the direct technical defect. Because the uiewp_export_field option gates what data is serialized into CSV exports - explicitly including password hashes per the description - the import-column-mapping exposure adds a second attack surface where attacker-controlled mappings could misdirect data during bulk user imports.

RemediationAI

No vendor-released patched version has been identified in the available intelligence; version 1.2 is the latest confirmed affected release and no successor tag appears in the referenced Subversion repository. Until an updated version is released, site administrators should deactivate and remove the User Management plugin entirely if the import/export functionality is not actively required, as this eliminates the attack surface with no trade-off beyond loss of CSV user-management features. If the plugin must remain active, restrict WordPress site access to trusted IPs at the web-server or WAF layer to reduce the unauthenticated network attack vector, noting this does not eliminate risk for multi-tenant or public-facing installations. Administrators should also audit the current value of the uiewp_export_field option in wp_options (SELECT option_value FROM wp_options WHERE option_name = 'uiewp_export_field') to detect whether it has already been tampered with to include sensitive fields such as password hashes or user_pass. Monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4f1d0a07-254c-4df9-90a4-966dff014df0?source=cve for patch availability updates.