CVE-2026-124413 · Package
NO FIX YET · SEE WHAT TO DO
WP User Manager, a WordPress plugin for managing users, has a missing authorization check that lets requests reach functions they should be blocked from. The sources say an attacker can exploit incorrectly configured access control levels, and the sources give a CVSS score of 5.3.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
The sources say the flaw affects WP User Manager up to and including version 2.10.4, which is a WordPress plugin. Sites running that plugin and exposing its user-management functions are the ones to look at. The sources do not say which access control settings are needed to trigger it.
Not affected if plugin-not-installed
Who cares wordpress, wp-user-manager
wp-user-manager plugin header; the sources say versions through 2.10.4 are affected2.10.4 but do not state a fixed version)Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.