User Management CVE-2026-12097

No authentication is required - the CVSS vector PR:N confirms the handler accepts unauthenticated requests. No special WordPress configuration or non-default feature flag is required; the vulnerability exists in the plugin's default installation across all versions through 1.2. The primary limiting factor is that the attacker cannot directly exfiltrate user data in a single step: they must first poison the export configuration (the exploitable action), and a subsequent CSV export must then be triggered - either by the attacker if the export endpoint is also unauthenticated, or by a legitimate administrator as an indirect path. The import column-mapping vector similarly requires a follow-on import action to have impact. The attack is therefore unauthenticated and network-accessible but may be two-stage in practice, requiring either an additional export-trigger request or administrator interaction to fully realize credential exposure.

The CVSS 3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) captures the direct, unauthenticated, low-complexity nature of the write but scores C:N - which reflects only the immediate action of modifying a configuration option, not the downstream exposure of password hashes that becomes possible once that configuration is set. Security teams should treat the real-world confidentiality risk as higher than the raw score implies: if any site administrator subsequently triggers a user export after an attacker has modified uiewp_export_field to include password hashes, hashed credentials for all users would appear in the output. No EPSS data was supplied in the intelligence package, so exploitation probability cannot be quantified. The absence of a CISA KEV entry and the lack of a reported POC reduce immediate operational urgency, but the zero-privilege, zero-interaction attack vector means any internet-connected WordPress installation running this plugin version is trivially reachable. The plugin's relatively niche footprint (obscure vendor, no evidence of widespread enterprise deployment) limits aggregate blast radius compared to core WordPress or major plugins, but individual sites that rely on this plugin for user CSV workflows face material credential-exposure risk from a simple, automatable HTTP request.

An unauthenticated attacker sends a crafted HTTP POST request to the WordPress site targeting the plugin's unguarded configuration handler, setting the uiewp_export_field option to include the user_pass field. When a site administrator later navigates to the plugin's export page and downloads the user CSV - a routine administrative task - the file contains bcrypt-hashed passwords for all registered users, which the attacker can retrieve if they also have read access to the export download URL or can socially engineer the CSV file. No public exploit code has been identified at time of analysis, but the attack requires no authentication or special conditions, making it trivially automatable against any vulnerable WordPress installation.