Live › vulnerability › CVE-2026-116846
WP User Manager, a WordPress plugin for user profiles and registration, has a missing authorization check that lets some users reach access control functions they should not. The sources do not say what data or actions an attacker gets beyond that.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-29 15:25 UTC. All times on this page are UTC.
No product ranges from the sources yet.
wp-user-manager plugin is installed and its version on the WordPress site (Plugins screen in the admin)2.9.26 are affected; the fixed version is unknownEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26.
This page as .md · .json · in your agent: get_signal("CVE-2026-116846")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.