WP User Manager EUVD-2026-98353

The target must run WP User Manager version 2.9.23 or earlier (no fixed version is stated in the input, 'n/a through 2.9.23'). The description does not name a specific feature toggle, protocol, or non-default setting - it attributes the flaw to 'incorrectly configured access control security levels' within the plugin's own permission model, consistent with a missing authorization check on a plugin action/endpoint. Per the CVSS vector (PR:N/UI:N), no authentication or user interaction is required, so exploitation works against affected installations without special configuration; the main limiting factors are simply having the vulnerable plugin version installed and active, and the low (confidentiality-only) impact ceiling.

This is a moderate, low-priority issue despite being network-reachable. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N = 5.3, MEDIUM) indicates a remotely reachable, low-complexity flaw requiring no privileges or user interaction, but the impact is limited to low confidentiality only - no integrity or availability impact and no scope change. The root cause is Missing Authorization (CWE-862), consistent with the Patchstack reference titling it a 'broken access control' flaw rather than a full authentication bypass. No EPSS score, SSVC decision data, KEV listing, or POC indicator is present in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of unauthenticated network access with only low confidentiality impact suggests a limited information-disclosure or restricted-action issue rather than a critical compromise. Note a minor tension: the 'Authentication Bypass' tag overstates the issue - the CWE and vendor reference describe missing/incorrect access-control checks (authorization), not authentication bypass; these are distinct and the authorization framing is more accurate.

A remote, unauthenticated attacker sends crafted requests to a WordPress site running WP User Manager ≤ 2.9.23, invoking a plugin endpoint or action whose authorization check is missing or misconfigured. This lets the attacker read data or reach functionality that should be restricted, yielding limited confidentiality disclosure. No public proof-of-concept is identified in the provided data.