CVE-2026-107423: WP User Manager Auth Bypass Vulnerability

CVE-2026-107423 Overview

CVE-2026-107423 is a missing authorization vulnerability in the WP User Manager plugin for WordPress. The flaw affects all versions of wp-user-manager up to and including 2.9.22. It stems from incorrectly configured access control security levels [CWE-862], allowing authenticated users with low privileges to perform actions they should not be permitted to execute. The vulnerability requires network access and low-level authentication, but no user interaction. Successful exploitation results in a limited integrity impact without affecting confidentiality or availability.

Critical Impact
Authenticated users with low-level privileges can bypass access controls in WP User Manager through version 2.9.22, enabling unauthorized modification of plugin-managed resources.

Affected Products

WP User Manager plugin for WordPress
All versions from n/a through 2.9.22
WordPress sites running wp-user-manager

Discovery Timeline

2026-10-12 - CVE-2026-107423 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-107423

Vulnerability Analysis

The vulnerability is categorized as Missing Authorization [CWE-862]. WP User Manager fails to verify whether a requesting user possesses the required capability before executing certain plugin actions. An attacker authenticated as a low-privileged user, such as a subscriber, can issue requests that the plugin processes without validating authorization context.

The impact is limited to integrity. There is no exposure of confidential data and no disruption to availability. However, unauthorized state changes within the plugin's user management functions can affect account attributes or related configuration data stored by the plugin.

Root Cause

The root cause is an incorrectly configured access control security level within one or more plugin endpoints. WP User Manager does not consistently invoke WordPress capability checks such as current_user_can() or nonce verification across all privileged actions. The absence of these checks allows request handlers to execute based solely on authentication status rather than role-based authorization.

Attack Vector

Exploitation requires a valid, authenticated WordPress account on the target site. The attacker sends a crafted HTTP request to an affected plugin endpoint over the network. Because the endpoint omits a proper authorization check, the request is processed with elevated effect. No social engineering or user interaction is required.

For technical details, see the Patchstack WP User Manager Vulnerability advisory.

Detection Methods for CVE-2026-107423

Indicators of Compromise

Unexpected modifications to user profile fields or metadata managed by WP User Manager
HTTP POST or AJAX requests to wp-user-manager endpoints originating from low-privileged accounts
Audit log entries showing privileged plugin actions performed by subscriber or customer-level accounts

Detection Strategies

Inventory WordPress installations and identify sites running wp-user-manager at or below version 2.9.22
Review web server access logs for requests to plugin AJAX actions or REST routes paired with unprivileged session cookies
Correlate authentication events with subsequent privileged plugin actions to flag authorization anomalies

Monitoring Recommendations

Enable WordPress audit logging to capture plugin configuration and user profile changes
Alert on any administrative-equivalent action performed by non-administrator accounts
Monitor wp-admin/admin-ajax.php traffic for unusual action parameters tied to the plugin

How to Mitigate CVE-2026-107423

Immediate Actions Required

Update WP User Manager to a version released after 2.9.22 that addresses the missing authorization check
Audit existing user accounts for unexpected privilege or profile changes
Restrict new account registration temporarily if the site accepts open signup

Patch Information

A fixed release addressing CVE-2026-107423 is tracked by Patchstack. Site administrators should consult the Patchstack advisory for the specific patched version and upgrade using the WordPress plugin updater.

Workarounds

Deactivate the WP User Manager plugin until the patched version can be installed
Deploy a Web Application Firewall rule to block requests to vulnerable plugin endpoints from non-administrator sessions
Enforce the principle of least privilege and remove unused low-privileged accounts

bash

# Update WP User Manager using WP-CLI
wp plugin update wp-user-manager

# Verify installed version
wp plugin get wp-user-manager --field=version

# Temporary deactivation if patch is unavailable
wp plugin deactivate wp-user-manager