New User Approve CVE-2026-28163

The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and low complexity - any unauthenticated remote attacker can attempt exploitation over HTTP/HTTPS. The target site must have the New User Approve plugin installed and active (not merely installed) running version 3.2.8 or earlier. There is no indication in available data that a non-default plugin configuration is required; the vulnerability appears to affect standard plugin operation. Exploitation is bounded by the integrity-only impact (I:L, C:N, A:N) - attackers cannot extract data or cause service disruption through this vector alone. The primary limiting factor is that impact is likely confined to user registration approval manipulation, making it most dangerous on sites where WordPress open registration is enabled and where the plugin's approval gate is the sole access control barrier.

The CVSS 5.3 Medium score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N reflects a remotely exploitable, low-complexity flaw requiring no authentication, but with impact limited strictly to integrity (I:L) - no confidentiality or availability components are affected. This narrows the blast radius to likely unauthorized manipulation of user approval decisions, such as self-approving a pending registration or bypassing the pending-approval gate. The vulnerability is not listed in CISA KEV, no EPSS score was provided in the available data, and no public POC has been identified, all of which reduce urgency relative to the raw CVSS vector. The tag 'Authentication Bypass' elevates practical concern - if the missing authorization allows unapproved users to elevate themselves to approved status, the real-world impact may exceed what I:L alone suggests, since it could grant site access to otherwise blocked accounts. This is a genuine priority for sites relying on the plugin's approval gate as a security control, but not an emergency for environments where WordPress registration is not open or where the plugin's approval workflow is not a trust boundary.

An unauthenticated attacker targeting a WordPress site with New User Approve ≤ 3.2.8 installed and active sends a crafted HTTP POST request to the site's WordPress AJAX or admin endpoint, invoking the vulnerable action without supplying administrator credentials. The missing authorization check allows the request to succeed, enabling the attacker to alter user approval statuses - for example, promoting their own pending registration to approved and gaining site access that would otherwise require administrator action. No public POC has been identified at time of analysis, though the low attack complexity (AC:L) makes independent rediscovery straightforward for a motivated attacker with basic WordPress internals knowledge.