EUVD-2026-55011
GHSA-c64r-rhpr-pqr5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
REST API is network-exposed by default; attacker must hold prior application password credentials, warranting PR:L; impact is capped at role-level read/write with no availability or scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
AnalysisAI
Block User Account WordPress plugin before 2.0.1 fails to enforce account suspension across every authentication path, leaving blocked users able to retain their full role-level read and write access through the WordPress REST API when they hold an application password created prior to being blocked. All sites running the plugin at versions below 2.0.1 are affected. A publicly available exploit exists per WPScan reporting, though no active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.17% (7th percentile) reflects limited observed real-world exploitation pressure.
Technical ContextAI
WordPress application passwords (introduced in WordPress 5.6) are distinct, per-application credentials that authenticate REST API requests independently of the standard wp-login.php login flow. The Block User Account plugin enforces its suspension logic by hooking into the standard authentication path but neglects the REST API authentication handler that processes application passwords. This constitutes CWE-287 (Improper Authentication): the security control is implemented incompletely, covering only one authentication vector while leaving the other unchecked. The affected product is identified in CPE as cpe:2.3:a:unknown:block_user_account:*:*:*:*:*:*:*:* across all versions before 2.0.1. Because WordPress REST API endpoints are enabled by default in nearly all WordPress installations, no special server configuration is required to expose the vulnerable path.
RemediationAI
Update the Block User Account WordPress plugin to version 2.0.1 or later, which is confirmed as the patched release per the WPScan advisory (https://wpscan.com/vulnerability/c80abded-9f0e-4e44-8c8a-b0d1bc1b16d0/) and ENISA EUVD-2026-55011. As an immediate compensating control prior to patching, administrators should manually revoke all application passwords for any blocked users via the WordPress admin panel under Users > Profile > Application Passwords - this eliminates the credential that enables bypass without requiring a plugin update. Note that this workaround must be applied per-user and does not prevent future application password creation, so patching remains the authoritative fix. No known side effects are associated with the plugin upgrade.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today