CVE-2026-18035: User Access Manager Information Disclosure

CVE-2026-18035 Overview

CVE-2026-18035 affects the User Access Manager WordPress plugin in versions prior to 2.3.15. The plugin fails to enforce its configured access restrictions against WordPress REST API requests. Unauthenticated attackers can read posts, pages, and custom post types that administrators restricted to specific user groups. The flaw stems from missing authorization checks [CWE-862] on REST API endpoints. Site operators who rely on User Access Manager to gate premium or internal content expose that content to anyone who can reach the site over the network.

Critical Impact
Unauthenticated remote attackers can retrieve access-restricted WordPress content by querying the REST API, bypassing the plugin's group-based restrictions entirely.

Affected Products

User Access Manager WordPress plugin versions before 2.3.15
WordPress installations using User Access Manager for content gating
Sites exposing the WordPress REST API (/wp-json/) to the internet

Discovery Timeline

2026-08-12 - CVE-2026-18035 published to NVD
2026-08-12 - Last updated in NVD database

Technical Details for CVE-2026-18035

Vulnerability Analysis

User Access Manager lets WordPress administrators restrict posts, pages, and custom post types to defined user groups. The plugin enforces these restrictions on standard WordPress front-end requests. It does not extend the same checks to requests handled by the WordPress REST API. An unauthenticated client can query endpoints such as /wp-json/wp/v2/posts or /wp-json/wp/v2/pages and receive the full content of items that should be hidden. The disclosure is limited to reading data; the vulnerability does not permit modification or denial of service, which aligns with the confidentiality-only impact noted in the CVSS vector.

Root Cause

The root cause is a missing authorization control [CWE-862]. The plugin registers its access-restriction logic against the traditional WordPress query loop but does not hook into the REST API's rest_prepare_{post_type} or permission callbacks. As a result, the REST controller returns restricted post objects without consulting User Access Manager's group membership checks. Version 2.3.15 adds the missing enforcement path.

Attack Vector

The attack requires only network access to the target WordPress site. No credentials, user interaction, or elevated privileges are needed. An attacker enumerates the site's REST API endpoints and issues GET requests for post types known to contain restricted content. The response includes the titles, content, and metadata of items that the plugin should have filtered. See the WPScan Vulnerability Report for technical details.

Detection Methods for CVE-2026-18035

Indicators of Compromise

Unauthenticated GET requests to /wp-json/wp/v2/posts, /wp-json/wp/v2/pages, or custom post type endpoints originating from a small set of IPs
HTTP 200 responses returning post IDs that match content flagged as restricted in User Access Manager
Sequential enumeration of post IDs via ?per_page= and ?page= query parameters against the REST API

Detection Strategies

Review web server access logs for anonymous requests to /wp-json/ endpoints, particularly those returning restricted post identifiers
Compare REST API response payloads against the plugin's restricted content list to identify successful bypass attempts
Deploy a WordPress security plugin or WAF rule that logs REST API responses containing gated post content

Monitoring Recommendations

Enable verbose logging of the WordPress REST API and forward logs to a centralized SIEM for correlation
Alert on spikes in anonymous /wp-json/wp/v2/ traffic that deviate from baseline
Track user agent strings and source IPs querying REST endpoints to identify scraping or enumeration behavior

How to Mitigate CVE-2026-18035

Immediate Actions Required

Upgrade the User Access Manager plugin to version 2.3.15 or later on every WordPress site in the environment
Audit REST API access logs for prior unauthenticated reads of restricted post types
Rotate any secrets, licensing keys, or internal information that may have been exposed through restricted posts

Patch Information

The vendor addressed the issue in User Access Manager 2.3.15 by adding access-restriction enforcement to REST API request handlers. Administrators should update through the WordPress plugin dashboard or by deploying the updated plugin package from the WPScan Vulnerability Report reference materials.

Workarounds

Disable the WordPress REST API for unauthenticated users using a security plugin or custom rest_authentication_errors filter until the update is applied
Restrict /wp-json/ access at the web server or WAF layer to authenticated sessions or trusted IP ranges
Move highly sensitive content off WordPress until the plugin update is verified in staging and production

bash

# Example nginx rule to block unauthenticated REST API access
location ~ ^/wp-json/ {
    if ($http_authorization = "") {
        return 401;
    }
}