EUVD-2026-105142
GHSA-74mv-xh25-c55c
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as low-privilege user
-
ExploitSend request to unprotected plugin action
-
ExecutionBypass missing authorization check
-
ImpactManipulate user state
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated account on the target WordPress site (CVSS PR:L), so an attacker needs at minimum valid low-privilege credentials - practical only where self-registration is enabled or the attacker already has a subscriber-level login. The condition is the plugin's missing authorization check on an action that changes user state in WP User Manager versions from n/a through 2.9.25. Limiting factors: no victim interaction is needed (UI:N), but the requirement for a logged-in account and the integrity-only, scope-unchanged impact (C:N/I:L/A:N, S:U) bound the damage to user-state manipulation rather than site takeover. |
| Impact | Signals point to a moderate, not urgent, priority. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, base 4.3) describes a network-reachable, low-complexity flaw that requires an authenticated low-privilege account (PR:L) and yields only limited integrity impact (I:L) with no confidentiality or availability loss - consistent with CWE-862 Missing Authorization allowing manipulation of user state. There is no KEV listing and no POC referenced in the input, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was supplied, so exploitation probability cannot be weighed. No SSVC decision data was provided. The one authority source is Patchstack, which classifies this as a broken-access-control issue. The main caveat: the flaw requires an existing authenticated account and only affects integrity in a limited way, so despite the network vector this is realistically a lower-risk, authorization-boundary bug rather than a critical remote-takeover issue - patch on a normal cycle unless the site allows untrusted user registration. |
| Exploit ScenarioDerived | On a site running WP User Manager up to 2.9.25, an attacker who holds (or self-registers for) a low-privilege account sends a request to a plugin action that fails to check authorization, altering user-state data they should not control. No public exploit code is referenced, and the limited integrity-only impact means the scenario is account/state manipulation rather than full compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 20, 2026
Missing authorization in WP User Manager through 2.9.25 lets an authenticated low-privilege user manipulate other users' state on a WordPress site, with integrity-only impact and no confidentiality or availability loss. The CVSS 3.1 score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), and exploitation requires a valid account such as a self-registered subscriber; no public exploit was identified at time of analysis and no CISA KEV entry is present in the supplied data.
RemediationAI
The supplied intelligence does not identify an exact vendor-released fixed version, so affected deployments should update WP User Manager to a release later than 2.9.25 once the vendor publishes it and confirm details through the Patchstack advisory URL. Until then, reduce practical exposure by disabling public self-registration or requiring administrator approval for new accounts (trade-off: reduced user onboarding), auditing and removing unused low-privilege accounts, and deactivating or removing the plugin if its user-management features are not needed (trade-off: loss of plugin functionality). Because exploitation requires an authenticated account, these controls lower the available attack surface; monitor for unexpected user-state changes.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
WP User Manager is a WordPress plugin for managing user profiles, registration, and account workflows. The CPE cpe:2.3:a:wp_user_manager:wp_user_manager:*:*:*:*:*:*:*:* identifies the affected plugin across versions through 2.9.25. The root cause is CWE-862 Missing Authorization: an action that changes user state lacks a proper capability or authorization check, so a logged-in low-privilege account can invoke it. The CVSS vector confirms network reachability, low privileges, no user interaction, scope unchanged, and only low integrity impact, which bounds the issue to user-state manipulation rather than site takeover.
Know when Wp User Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Authenticated low-privilege account needed so PR:L; network-reachable WordPress action with no user interaction gives AV:N/AC:L/UI:N; impact is limited user-state change, so I:L and C:A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wp User Manager
View allUnauthenticated privilege escalation in the WP User Manager WordPress plugin (versions 2.9.21 through 2.9.25) allows an
Arbitrary file deletion in the WordPress WP User Manager plugin versions 2.9.16 and earlier allows authenticated subscri
Improper access control in the WP User Manager plugin for WordPress, affecting all versions through 2.9.20, allows remot
Missing authorization in the WordPress plugin WP User Manager (all versions through 2.9.23) allows remote attackers to r
WP User Manager, a WordPress plugin for front-end user profiles, registration, and login, up to and including version 2.
Missing authorization checks in the WP User Manager plugin for WordPress (versions through 2.9.22) let an authenticated
Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.9.10. Rated medium se
The WP User Manager - User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of dat
The WP User Manager - User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification
Exploit-DB