{"id":"CVE-2026-124413","kind":"vulnerability","aliases":["CVE-2026-124413"],"related":[],"title":"WP User Manager WordPress plugin: missing authorization check through 2.10.4","description":"Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4.","summary":"WP User Manager, a WordPress plugin for managing users, has a missing authorization check that lets requests reach functions they should be blocked from. The sources say an attacker can exploit incorrectly configured access control levels, and the sources give a CVSS score of 5.3.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-user-manager"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP User Manager version in the WordPress admin plugin list or the `wp-user-manager` plugin header; the sources say versions through `2.10.4` are affected","fix":"- WP User Manager: unknown (the sources name the affected range through `2.10.4` but do not state a fixed version)","status":"open","published_at":"2026-11-11T12:19:47+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","triaged_at":"2026-11-11T12:28:54+00:00","updated_at":"2026-11-11T12:28:54+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-11T12:28:54Z","model":"claude-haiku-5-5","output":{"fix":"- WP User Manager: unknown (the sources name the affected range through `2.10.4` but do not state a fixed version)","reach":"internet","title":"WP User Manager WordPress plugin: missing authorization check through 2.10.4","impact":"medium","summary":"WP User Manager, a WordPress plugin for managing users, has a missing authorization check that lets requests reach functions they should be blocked from. The sources say an attacker can exploit incorrectly configured access control levels, and the sources give a CVSS score of 5.3.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-user-manager"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access to user management functions on the site","analyst_note":"Check the NVD entry and WP User Manager changelog for the fixed version and the exact unauthorized action.","how_to_check":"- Check the installed WP User Manager version in the WordPress admin plugin list or the `wp-user-manager` plugin header; the sources say versions through `2.10.4` are affected\n- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"The sources say the flaw affects WP User Manager up to and including version 2.10.4, which is a WordPress plugin. Sites running that plugin and exposing its user-management functions are the ones to look at. The sources do not say which access control settings are needed to trigger it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4544,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-124413':13A,16A '-2026':12A,15A '2.10.4':10A,98C '5.3':67B 'access':56B,86C 'affect':91C 'allow':82C 'attack':51B 'author':7A,35B,69C 'block':45B 'check':8A,36B 'configur':55B,85C 'control':57B,87C 'cve':11A,14A 'cvss':64B 'exploit':53B,83C 'function':41B 'give':62B 'incorrect':54B,84C 'issu':90C 'let':38B 'level':58B 'levels.this':89C 'manag':3A,22B,25B,30B,74C,77C,81C,94C 'miss':6A,34B,68C 'n/a':96C 'packag':17B 'plugin':5A,28B 'reach':40B 'request':39B 'say':49B 'score':65B 'secur':88C 'sourc':48B,61B 'user':2A,21B,24B,31B,73C,76C,80C,93C 'vulner':70C 'wordpress':4A,18B,27B 'wp':1A,20B,23B,72C,75C,79C,92C 'wp-user-manag':19B,78C","nicknames":[],"mitigations":[],"who_affected":"The sources say the flaw affects WP User Manager up to and including version 2.10.4, which is a WordPress plugin. Sites running that plugin and exposing its user-management functions are the ones to look at. The sources do not say which access control settings are needed to trigger it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wordpress","wpusermanager"],"campaign_type":null,"search_a":"'-124413':13A,16A '-2026':12A,15A '2.10.4':10A 'author':7A 'check':8A 'cve':11A,14A 'manag':3A 'miss':6A 'plugin':5A 'user':2A 'wordpress':4A 'wp':1A","search_b":"'5.3':67B 'access':56B 'attack':51B 'author':35B 'block':45B 'check':36B 'configur':55B 'control':57B 'cvss':64B 'exploit':53B 'function':41B 'give':62B 'incorrect':54B 'let':38B 'level':58B 'manag':22B,25B,30B 'miss':34B 'packag':17B 'plugin':28B 'reach':40B 'request':39B 'say':49B 'score':65B 'sourc':48B,61B 'user':21B,24B,31B 'wordpress':18B,27B 'wp':20B,23B 'wp-user-manag':19B","search_c":"'2.10.4':98C 'access':86C 'affect':91C 'allow':82C 'author':69C 'configur':85C 'control':87C 'exploit':83C 'incorrect':84C 'issu':90C 'levels.this':89C 'manag':74C,77C,81C,94C 'miss':68C 'n/a':96C 'secur':88C 'user':73C,76C,80C,93C 'vulner':70C 'wp':72C,75C,79C,92C 'wp-user-manag':78C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124413","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124413","severity":null,"published_at":"2026-11-11T12:19:47+00:00","modified_at":"2026-11-11T12:19:47+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","fetched_at":"2026-11-11T12:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}