Live › vulnerability › CVE-2026-112823
Go to dashboardWP User Manager, a WordPress plugin for user profiles and registration, has a missing authorization check that lets a request manipulate user state. An attacker with access to the affected endpoint can change user accounts they should not be able to modify.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running WP User Manager at version or earlier are in scope, per the description, which gives no version lower bound. Sites without the plugin installed or with it deactivated can skip this. The sources do not say which endpoints or roles are reachable without a login.
2.9.25No product ranges from the sources yet.
wp plugin get wp-user-manager --field=version2.9.25, as listed by the plugin's vendorEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.
This page as .md · .json · in your agent: get_signal("CVE-2026-112823")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.