WP User Manager EUVD-2026-97298

Requires an authenticated low-privileged account on a WordPress site running WP User Manager (<= 2.9.22); because the plugin provides front-end user registration and profile management, such accounts are often self-obtainable where open registration is enabled, which raises practical reach. Exploitation is limited by the need for that account (PR:L - not reachable by fully anonymous attackers), and the impact is confined to unauthorized integrity changes (C:N/A:N), so no data exfiltration or denial of service results. The specific plugin action/endpoint lacking the authorization check is not named in the available data and should be confirmed from the Patchstack advisory.

This is a genuine but modest-priority issue, best characterized as a high-volume/low-impact WordPress plugin flaw rather than an urgent emergency. The CVSS 3.1 base score of 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N indicates network-reachable, low-complexity exploitation that requires an existing low-privileged authenticated account (PR:L), no user interaction, and yields only a limited integrity impact (I:L) with no confidentiality or availability loss - consistent with CWE-862 Missing Authorization, where an under-privileged user can perform actions reserved for higher roles. No EPSS score, CISA KEV listing, SSVC decision data, or proof-of-concept was provided in the input, so exploitation likelihood cannot be quantified from the data; the only intelligence signal is the Patchstack advisory that catalogued it. The signals are internally consistent (network vector matches a web-facing WordPress plugin, PR:L matches a broken-access-control issue requiring a registered account), with no direct contradictions. Note one labeling inconsistency to verify: the input tags this as 'Authentication Bypass', but CWE-862 and the referenced advisory describe broken access control / missing authorization (privilege escalation of an already-authenticated user), which is a distinct weakness - do not treat this as a pre-authentication bypass.

An attacker who holds or self-registers a low-privileged account (e.g., a subscriber on a site using WP User Manager for front-end registration) sends crafted requests to a plugin endpoint that fails to verify the caller's authorization, performing an action or modifying data normally restricted to higher-privileged users. No public exploit code was identified at time of analysis, and the limited integrity-only impact means the result is unauthorized modification rather than full site takeover or data disclosure.