Disable Users CVE-2026-88827

The attacker must possess valid login credentials for an account that an administrator has specifically marked as disabled via the Disable Users plugin (versions through 1.0.5). Exploitation depends on authenticating through an authentication path on which the plugin fails to enforce its disable control (the description states the control is not applied to 'all authentication paths'), rather than the standard web login form the plugin does protect. Limiting factors: the attacker needs pre-existing knowledge of the account's credentials (PR:L - no anonymous access), the account must have previously been disabled (so the site must use this plugin for access revocation), and the regained privilege level is bounded by whatever role that account held.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) and the CWE-287 classification are internally consistent: a network-reachable authentication bypass with low attack complexity and full CIA impact. The key moderating signal is PR:L - exploitation is not open to anonymous internet attackers but is limited to the holder of a specific account that an administrator has already disabled (e.g. a terminated employee, revoked contractor, or offboarded user). Publicly available exploit code exists (reported by WPScan), which raises practical risk, but this must not be conflated with active exploitation: there is no CISA KEV listing and no EPSS score was provided, so widespread opportunistic exploitation cannot be asserted from the data. The realistic threat is targeted insider/offboarding abuse rather than mass scanning. Net: a genuinely serious access-control failure for any site that relies on this plugin to revoke access, but the PR:L precondition and absence of KEV/EPSS data place it below a drop-everything emergency for most deployments. EPSS and KEV data are MISSING from the input and should be checked before final prioritization.

An administrator uses the Disable Users plugin to disable a departed employee's account, assuming access is revoked. Because the control is not enforced on every authentication path, the former employee logs in through an alternate path (e.g. an XML-RPC, REST, or application-password flow) and regains the account's full privileges. A public WPScan exploit entry lowers the effort required to reproduce this.