EUVD-2026-63325
GHSA-3ph6-9wp8-h8w5
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-reachable, no credentials required per CVSS PR:N; integrity-only impact limited to approval state manipulation with no confidentiality or availability component.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects New User Approve: from n/a through 3.2.8.
AnalysisAI
Missing Authorization in myCred's New User Approve WordPress plugin through version 3.2.8 permits unauthenticated remote attackers to exploit incorrectly configured access control security levels, resulting in unauthorized integrity modifications - most likely manipulation of user registration approval states. Reported by Patchstack and assigned a CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, the flaw is exploitable without credentials or user interaction against any WordPress site running the affected plugin. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The CVSS vector AV:N/AC:L/PR:N/UI:N confirms exploitation requires no authentication, no user interaction, and low complexity - any unauthenticated remote attacker can attempt exploitation over HTTP/HTTPS. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.3 Medium score with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N reflects a remotely exploitable, low-complexity flaw requiring no authentication, but with impact limited strictly to integrity (I:L) - no confidentiality or availability components are affected. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | WordPress site administrators should update the New User Approve plugin to a version beyond 3.2.8 as soon as a patched release is available from the WordPress plugin repository or myCred. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in New User Approve
View allThe New User Approve WordPress plugin before 2.4 does not have CSRF check in place when updating its settings and adding
The New User Approve plugin for WordPress versions 3.2.3 and earlier contains a missing authorization check that allows
Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve.5.1. Rated medium severity (CVSS 4.3), t
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today