New User Approve CVE-2026-25390

While a formal CVSS score and EPSS exploitation probability are not available, the vulnerability's real-world risk is moderate to moderately-high based on available signals. The CWE-862 classification (Missing Authorization) is a well-known, easily exploitable weakness that typically requires low attack complexity and no elevated privileges—an unauthenticated attacker could potentially approve or reject users, modify user data, or escalate privileges. The fact that this is a WordPress plugin significantly increases real-world risk because WordPress installations are ubiquitous and often poorly maintained; the plugin's user approval function is security-critical. The absence of a published POC and KEV designation suggests limited active exploitation at present, but the straightforward nature of authorization bypasses means that remediation should be treated with urgency. Organizations using New User Approve should prioritize patching, as the technical impact of broken access control on user registration workflows is substantial—an attacker could grant themselves or malicious accounts administrative access.

An attacker visits a WordPress site using the vulnerable New User Approve plugin and registers a new user account. Because the plugin fails to properly verify authorization, the attacker can directly access or manipulate the user approval workflow—either via a direct URL, REST API endpoint, or form submission—to self-approve their account or elevate their role to administrator without waiting for legitimate approval from a site moderator. Alternatively, the attacker could enumerate and modify other pending users' approval status, deleting moderation records or granting unauthorized access to malicious accounts. The low attack complexity (no special tools required beyond a web browser) and the lack of privilege escalation barriers make this a practical, high-impact attack vector for any WordPress site relying on the New User Approve plugin for access control.