{"id":"CVE-2026-121575","kind":"vulnerability","aliases":["CVE-2026-121575"],"related":[],"title":"WP User Manager WordPress plugin: missing authorization check through 2.10.4","description":"Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4.","summary":"WP User Manager, a WordPress plugin for managing users, has a missing authorization check that lets actions run without proper access control. The sources do not say what data or actions an attacker can reach.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-user-manager"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `wp-user-manager` plugin is installed and its version in the WordPress admin under Plugins","fix":"- WP User Manager: move to a version after `2.10.4`; the exact fixed version is unknown from the sources","status":"open","published_at":"2026-11-07T13:16:35+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","triaged_at":"2026-11-07T13:49:35+00:00","updated_at":"2026-11-07T13:49:35+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T13:49:35Z","model":"claude-haiku-5-5","output":{"fix":"- WP User Manager: move to a version after `2.10.4`; the exact fixed version is unknown from the sources","reach":"internet","title":"WP User Manager WordPress plugin: missing authorization check through 2.10.4","impact":"medium","summary":"WP User Manager, a WordPress plugin for managing users, has a missing authorization check that lets actions run without proper access control. The sources do not say what data or actions an attacker can reach.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-user-manager","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access control bypass on WordPress site","analyst_note":"Check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-121575 for the affected version range and the exact fixed version.","how_to_check":"- Check whether the `wp-user-manager` plugin is installed and its version in the WordPress admin under Plugins\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the WP User Manager WordPress plugin at version 2.10.4 or earlier are affected. The sources do not say which configurations or roles make the missing check reachable.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4216,"output_tokens":504,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121575':13A,16A '-2026':12A,15A '2.10.4':10A,91C 'access':46B,79C 'action':42B,56B 'affect':84C 'allow':75C 'attack':58B 'author':7A,38B,62C 'check':8A,39B 'configur':78C 'control':47B,80C 'cve':11A,14A 'data':54B 'exploit':76C 'host':20B 'incorrect':77C 'issu':83C 'let':41B 'levels.this':82C 'manag':3A,25B,28B,33B,67C,70C,74C,87C 'miss':6A,37B,61C 'n/a':89C 'packag':17B 'plugin':5A,31B 'proper':45B 'reach':60B 'run':43B 'say':52B 'secur':81C 'self':19B 'self-host':18B 'sourc':49B 'user':2A,24B,27B,34B,66C,69C,73C,86C 'vulner':63C 'without':44B 'wordpress':4A,21B,30B 'wp':1A,23B,26B,65C,68C,72C,85C 'wp-user-manag':22B,71C","nicknames":[],"mitigations":[],"who_affected":"Sites running the WP User Manager WordPress plugin at version 2.10.4 or earlier are affected. The sources do not say which configurations or roles make the missing check reachable.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpusermanager"],"campaign_type":null,"search_a":"'-121575':13A,16A '-2026':12A,15A '2.10.4':10A 'author':7A 'check':8A 'cve':11A,14A 'manag':3A 'miss':6A 'plugin':5A 'user':2A 'wordpress':4A 'wp':1A","search_b":"'access':46B 'action':42B,56B 'attack':58B 'author':38B 'check':39B 'control':47B 'data':54B 'host':20B 'let':41B 'manag':25B,28B,33B 'miss':37B 'packag':17B 'plugin':31B 'proper':45B 'reach':60B 'run':43B 'say':52B 'self':19B 'self-host':18B 'sourc':49B 'user':24B,27B,34B 'without':44B 'wordpress':21B,30B 'wp':23B,26B 'wp-user-manag':22B","search_c":"'2.10.4':91C 'access':79C 'affect':84C 'allow':75C 'author':62C 'configur':78C 'control':80C 'exploit':76C 'incorrect':77C 'issu':83C 'levels.this':82C 'manag':67C,70C,74C,87C 'miss':61C 'n/a':89C 'secur':81C 'user':66C,69C,73C,86C 'vulner':63C 'wp':65C,68C,72C,85C 'wp-user-manag':71C","first_public_at":"2026-11-07T13:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121575","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121575","severity":null,"published_at":"2026-11-07T13:16:35+00:00","modified_at":"2026-11-07T13:16:35+00:00","first_seen_at":"2026-11-07T13:47:25+00:00","fetched_at":"2026-11-07T13:47:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}