New User Approve CVE-2026-83560

Exploitable only when the plugin's integration feature is left unconfigured - in that state a set of integration REST API routes fail to verify authentication, exposing the user-data endpoint to unauthenticated network callers. This is likely the default/out-of-the-box state for administrators who have not set up an integration, widening real exposure. Limiting factors: sites that have configured the integration are not affected, the leak is confined to low-sensitivity PII (id, username, email, registration date) with no write or control-plane impact, and version 3.2.10 remediates it. Affects New User Approve 3.1.0 through versions before 3.2.10.

This is a genuine but moderate-severity unauthenticated information-disclosure flaw. The vendor CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3) is internally consistent with the description: a network-reachable REST API endpoint requires no authentication or user interaction, leaks only limited confidential data (usernames, email addresses, registration dates), and has no integrity or availability impact - hence C:L only. The SSVC framework corroborates this: Exploitation=none (no observed in-the-wild activity), Automatable=yes (the endpoint can be trivially scripted/scraped en masse), and Technical Impact=partial (matching C:L). No EPSS score, KEV listing, or public POC was provided, so exploitation status is: no public exploit identified at time of analysis. The signals are aligned rather than conflicting - this is a real but low-priority issue: attractive for bulk username/email harvesting (spam, credential-stuffing target lists, phishing recon) precisely because it is automatable and unauthenticated, but it does not lead to compromise on its own. Prioritize patching where the plugin is deployed with the integration left unconfigured, but this does not warrant emergency response.

An attacker scans WordPress sites running New User Approve and, on any site where the integration feature is left unconfigured (a likely default state), sends unauthenticated HTTP requests to the affected integration REST API routes. The endpoint returns registered users' IDs, usernames, email addresses, and registration dates, which the attacker scripts to bulk-harvest across many sites for phishing, spam, or credential-stuffing target lists. No public exploit code was identified in the provided data, but the flaw is trivially automatable.