EUVD-2026-85469
GHSA-94w8-whr9-9mv3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running WP User Manager ≤2.9.19
-
ExploitSend crafted unauthenticated request to unprotected endpoint
-
ExecutionBypass missing authorization check (CWE-862)
-
ImpactModify restricted data or trigger privileged action
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires only that a WordPress site have the WP User Manager plugin at version ≤2.9.19 installed and reachable over the network; per AV:N/AC:L/PR:N/UI:N no authentication, no victim interaction, and no non-default configuration are needed. Exploitation is limited by the impact scope: only a partial integrity change (I:L) is possible - no data disclosure or denial of service - and the exact restricted action or object protected by the missing authorization check is not specified in the available data, which constrains how attackers can leverage it. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3) describes a remotely reachable, unauthenticated, low-complexity flaw requiring no user interaction, but with impact limited to a partial integrity loss (I:L) and no confidentiality or availability effect - consistent with CWE-862 missing authorization allowing an unauthorized user to perform an action or modify a limited set of data they should not. The magnitude is modest: no direct data disclosure and no service impact, so despite the fully-remote unauthenticated profile this is a moderate, not critical, issue. No EPSS score, KEV listing, POC, SSVC decision, or fixed version is present in the supplied data, so there is no signal of active or automated exploitation; exploitation status is therefore unconfirmed. Note a labeling tension: the tag calls this 'Authentication Bypass,' but the CWE (862, missing authorization) and description ('Broken Access Control') describe an authorization defect, not an authentication bypass - verify the exact impacted action with Patchstack. Overall this is a real-but-low-priority patch-when-convenient issue rather than an urgent threat. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP request to a vulnerable WP User Manager endpoint that fails to check authorization, invoking an action or altering data restricted to privileged users. Because the CVSS vector is AV:N/PR:N/UI:N, this needs only network reach to the WordPress site and no login or victim interaction, though the impact is confined to a partial integrity change (I:L). No public exploit code is referenced in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 23, 2026
WP User Manager, a WordPress plugin for front-end user profiles, registration, and login, up to and including version 2.9.19 contains an unauthenticated broken access control flaw (CWE-862) that lets a remote attacker perform an action or modify data that should require authorization. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N (base 5.3) means the endpoint is reachable over the network with no credentials, no victim interaction, and no special configuration, but the impact is capped at a partial integrity loss - there is no data disclosure and no denial of service, and the exact restricted action protected by the missing check is not specified in the available data. No public exploit code was identified and there is no evidence of confirmed active exploitation (not listed in CISA KEV) at time of analysis, and Patchstack's advisory is the originating report.
RemediationAI
No vendor-released patch or fixed version is identified in the available data, so remediation should begin by confirming the installed version of WP User Manager and treating 2.9.19 and earlier as vulnerable; check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/wp-user-manager/vulnerability/wordpress-wp-user-manager-plugin-2-9-19-broken-access-control-vulnerability?_s_id=cve) and the WordPress.org plugin page for a release newer than 2.9.19 and apply it as soon as one is published. Where the plugin is not required for business functionality, deactivating and removing it is the strongest mitigation; the trade-off is the loss of front-end registration, login, and profile features, which would need to be replaced by another plugin or by WordPress core functionality. If the plugin must remain active pending a fix, use a web application firewall or reverse-proxy rule to block unauthenticated requests to the plugin's reachable endpoints - its admin-ajax.php actions and any /wp-json/wp-user-manager/ REST routes - restricting them to authenticated sessions where the legitimate workflow allows; the trade-off is that anonymous registration or password-reset flows may break and will need to be tested, and action-name-based rules can be evaded if the plugin uses multiple or dynamically constructed action names. Additional compensating controls include monitoring web and application logs for anomalous unauthenticated requests to those endpoints, alerting on unexpected user-meta or profile changes, and ensuring the site follows least-privilege WordPress hardening so that any unauthorized modification an attacker achieves remains bounded; none of these controls remove the underlying missing authorization check, so they should be considered temporary until a patched release is installed.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a missing-authorization defect (CWE-862) in a WordPress plugin component. WP User Manager registers front-end user workflows - registration, login, password reset, profile editing, and custom field handling - which in WordPress are typically exposed through admin-ajax.php actions (frequently via wp_ajax_nopriv_* hooks that explicitly serve unauthenticated visitors) or through WP REST API routes whose permission_callback is permissive. A CWE-862 failure occurs when such a handler performs a state-changing operation without verifying a capability (e.g., current_user_can()), the requesting user's identity, or a valid nonce, so any unauthenticated caller reaching the endpoint can trigger it. The PR:N/UI:N/AC:L components of the assessed vector confirm the vulnerable path is exposed to anonymous network requests with no prerequisites, while the C:N/A:N/I:L profile indicates the abused action only mutates a limited, partially attacker-controllable value rather than leaking or destroying data. The CPE supplied in the intelligence (cpe:2.3:a:wp_user_manager:wp_user_manager:*:*:*:*:*:*:*:*) is wildcarded and therefore does not encode an upper bound; the actionable range comes from the ENISA EUVD entry, which states WP User Manager versions up to and including 2.9.19 are affected. The specific function or endpoint involved is not disclosed in the available data, so the precise modification primitive cannot be enumerated from these sources.
Know when Wp User Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Unauthenticated network-reachable missing-authorization flaw (PR:N, AC:L) with impact limited to partial unauthorized modification, so I:L and C:N/A:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Wp User Manager
View allArbitrary file deletion in the WordPress WP User Manager plugin versions 2.9.16 and earlier allows authenticated subscri
Improper access control in the WP User Manager plugin for WordPress, affecting all versions through 2.9.20, allows remot
Missing authorization in the WordPress plugin WP User Manager (all versions through 2.9.23) allows remote attackers to r
Missing authorization checks in the WP User Manager plugin for WordPress (versions through 2.9.22) let an authenticated
Cross-Site Request Forgery (CSRF) vulnerability in WP User Manager WP User Manager wp-user-manager.9.10. Rated medium se
The WP User Manager - User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of dat
The WP User Manager - User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification
Exploit-DB