{"id":"CVE-2026-112823","kind":"vulnerability","aliases":["CVE-2026-112823"],"related":[],"title":"WP User Manager: missing authorization lets users change other users' state","description":"Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.","summary":"WP User Manager, a WordPress plugin for user profiles and registration, has a missing authorization check that lets a request manipulate user state. An attacker with access to the affected endpoint can change user accounts they should not be able to modify.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-user-manager"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP User Manager plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-user-manager --field=version`\n- Confirm whether the plugin is active on the site","fix":"- Update WP User Manager to a release newer than `2.9.25`, as listed by the plugin's vendor\n- unknown whether a patched version number is stated in the sources","status":"open","published_at":"2026-10-20T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","triaged_at":"2026-10-25T04:39:25+00:00","updated_at":"2026-10-25T04:39:25+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-10-25T04:39:25Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP User Manager to a release newer than `2.9.25`, as listed by the plugin's vendor\n- unknown whether a patched version number is stated in the sources","reach":"internet","title":"WP User Manager: missing authorization lets users change other users' state","impact":"medium","summary":"WP User Manager, a WordPress plugin for user profiles and registration, has a missing authorization check that lets a request manipulate user state. An attacker with access to the affected endpoint can change user accounts they should not be able to modify.","category":"package","nicknames":[],"who_cares":["wordpress","wp-user-manager","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Attacker alters other users' account state without authorization.","analyst_note":"","how_to_check":"- Check the installed WP User Manager plugin version in the WordPress admin under Plugins, or with `wp plugin get wp-user-manager --field=version`\n- Confirm whether the plugin is active on the site","needs_analyst":false,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WP User Manager at version `2.9.25` or earlier are in scope, per the description, which gives no version lower bound. Sites without the plugin installed or with it deactivated can skip this. The sources do not say which endpoints or roles are reachable without a login.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000583,"input_tokens":3287,"output_tokens":509,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-112823':14A,17A '-2026':13A,16A '2.9.25':95C 'abl':66B 'access':53B 'account':61B 'affect':56B,88C 'allow':83C 'attack':51B 'author':5A,41B,70C 'chang':8A,59B 'check':42B 'cve':12A,15A 'endpoint':57B 'host':21B 'issu':87C 'let':6A,44B 'manag':3A,26B,29B,75C,78C,82C,91C 'manipul':47B,84C 'miss':4A,40B,69C 'modifi':68B 'n/a':93C 'packag':18B 'plugin':32B 'profil':35B 'registr':37B 'request':46B 'self':20B 'self-host':19B 'state':11A,49B 'state.this':86C 'user':2A,7A,10A,25B,28B,34B,48B,60B,74C,77C,81C,85C,90C 'vulner':71C 'wordpress':22B,31B 'wp':1A,24B,27B,73C,76C,80C,89C 'wp-user-manag':23B,79C","nicknames":[],"mitigations":[],"who_affected":"Sites running WP User Manager at version `2.9.25` or earlier are in scope, per the description, which gives no version lower bound. Sites without the plugin installed or with it deactivated can skip this. The sources do not say which endpoints or roles are reachable without a login.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T16:17:03+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112823","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112823","severity":null,"published_at":"2026-10-20T16:17:03+00:00","modified_at":"2026-10-21T11:17:06+00:00","first_seen_at":"2026-10-23T21:57:20+00:00","fetched_at":"2026-10-23T22:28:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}