What is the CVSS score of EUVD-2026-57093?

EUVD-2026-57093 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 15.0%.

Is there a public PoC exploit available for EUVD-2026-57093?

Yes, a public proof-of-concept exploit is available for EUVD-2026-57093. Prioritise patching immediately. EPSS: 15.0%.

Is there a patch available for EUVD-2026-57093?

Yes, a patch is available for EUVD-2026-57093. Update the affected software to the latest version immediately.

User Access Manager EUVD-2026-57093

| CVE-2026-18035 MEDIUM

Missing Authorization (CWE-862)

2026-08-12 WPScan

GHSA-x37j-q2h4-mfmw

WordPress Authentication Bypass User Access Manager Unknown

5.3

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Network-accessible REST API, no credentials required, confidentiality-only impact limited to plugin-restricted content; no integrity or availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 18:26 vuln.today

Patch available

Aug 12, 2026 - 07:16 EUVD

CVE Published

Aug 12, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 12, 2026 - 06:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.

AnalysisAI

User Access Manager WordPress plugin before version 2.3.15 exposes restricted content to unauthenticated attackers via the WordPress REST API, which the plugin fails to protect with its own access control logic. Any post, page, or custom post type configured to be visible only to specific user groups can be silently read through standard REST API endpoints without credentials. A publicly available proof-of-concept exists (WPScan), and with an EPSS of 15% and automatable exploitation, this is a realistic risk for any WordPress site using this plugin to gate premium or sensitive content.

Technical ContextAI

CWE-862 (Missing Authorization) describes a code path that performs a sensitive action without verifying the caller has permission - precisely what occurs here. The WordPress REST API (introduced in WordPress 4.7) provides a parallel access layer to content that bypasses traditional page-rendering hooks. The User Access Manager plugin enforces its group-based restrictions via filters applied to standard WordPress queries, but fails to register equivalent authorization checks on REST API routes. This means the plugin's access gate only operates on the classic frontend and admin paths, leaving /wp-json/ endpoints unprotected. CPE data identifies the affected component as cpe:2.3:a:unknown:user_access_manager:*:*:*:*:*:*:*:*, covering all versions prior to 2.3.15.

RemediationAI

Vendor-released patch: 2.3.15. WordPress site administrators should update the User Access Manager plugin to version 2.3.15 or later immediately via the WordPress admin dashboard or wp-cli (wp plugin update user-access-manager). If an immediate update is not feasible, a compensating control is to disable REST API access for unauthenticated users entirely - this can be achieved via a code snippet or a dedicated plugin such as 'Disable REST API', which blocks /wp-json/ endpoints for non-logged-in users. The trade-off of this workaround is that it may break third-party integrations or headless WordPress setups relying on public REST API access. A more surgical workaround is to restrict REST API routes matching /wp/v2/posts, /wp/v2/pages, and custom post type routes at the web server or WAF layer for unauthenticated requests. Advisory and exploit reference: https://wpscan.com/vulnerability/9c5cae62-4c4c-434b-ae40-4654b257803f/.