CVE-2026-18352: User Access Manager Path Traversal Flaw

CVE-2026-18352 Overview

CVE-2026-18352 is a directory traversal vulnerability [CWE-22] in the User Access Manager plugin for WordPress. The flaw affects all versions up to and including 2.3.15 through the uamgetfile parameter. Unauthenticated attackers can read arbitrary files on the underlying server by chaining a traversal path with a valid ?attachment_id parameter. The plugin's access check passes against the legitimate public attachment referenced by the ID, while the file stream returns the attacker-chosen path.

Critical Impact
Unauthenticated remote attackers can read arbitrary server files, including WordPress configuration files containing database credentials and secret keys.

Affected Products

WordPress User Access Manager plugin versions up to and including 2.3.15
WordPress sites installing the plugin from the official plugin repository
Any hosting environment running affected user-access-manager releases

Discovery Timeline

2026-08-02 - CVE-2026-18352 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-18352

Vulnerability Analysis

The User Access Manager plugin exposes a file-serving endpoint controlled by the uamgetfile request parameter. When an attacker supplies a traversal path such as ../../../../etc/passwd, the plugin calls attachment_url_to_postid() to resolve the file to a known post. The lookup returns 0 for any path that is not a registered attachment. Rather than rejecting the request, the plugin falls back to the current global post context.

An attacker satisfies the access check by also supplying a valid ?attachment_id pointing to a legitimate public attachment. The plugin evaluates authorization against that public attachment, permits the request, and then streams the file identified by the traversal path. The confusion between the authorization target and the served resource is the core defect.

Root Cause

The root cause is inconsistent state between authorization and file streaming. The BaseControllerTrait, RedirectController, and FileHandler components resolve the served path from uamgetfile while the access decision resolves from the global post populated by attachment_id. Traversal characters are not normalized or rejected before disk access.

Attack Vector

Exploitation requires only network access to a vulnerable WordPress site. The attacker crafts a single GET request combining a valid attachment_id with a uamgetfile value containing directory traversal sequences. No authentication, user interaction, or elevated privileges are required. Successful requests return the raw contents of files readable by the web server user, including wp-config.php, private keys, and application logs.

Detection Methods for CVE-2026-18352

Indicators of Compromise

HTTP requests containing both uamgetfile and attachment_id query parameters against WordPress endpoints
uamgetfile values containing ../, ..\, URL-encoded %2e%2e%2f, or absolute paths outside the uploads directory
Web server access logs showing successful 200 responses for uamgetfile requests referencing system files such as wp-config.php, /etc/passwd, or .env

Detection Strategies

Inspect WordPress access logs for query strings that combine uamgetfile with path traversal sequences and correlate with unusual response sizes
Enable WAF rules that block traversal characters in the uamgetfile parameter and flag paths outside the WordPress uploads directory
Audit installed plugin versions to identify hosts still running user-access-manager at or below 2.3.15

Monitoring Recommendations

Alert on outbound reads of sensitive files (wp-config.php, SSH keys, .env) initiated by the PHP-FPM or Apache process
Monitor for repeated uamgetfile requests from a single source IP, which often indicate automated file enumeration
Track plugin inventory drift across managed WordPress fleets to identify unpatched installations

How to Mitigate CVE-2026-18352

Immediate Actions Required

Update the User Access Manager plugin to a version above 2.3.15 that includes the fix referenced in the vendor changeset
Temporarily deactivate the plugin on any site that cannot be patched immediately
Rotate WordPress secret keys and database credentials if log analysis shows successful traversal requests

Patch Information

The vendor addressed the vulnerability in the WordPress User Access Manager Changeset. The fix hardens path resolution so that uamgetfile values that do not resolve to a valid attachment are rejected instead of falling back to the global post context. Review the Wordfence Vulnerability Analysis for additional context.

Workarounds

Deploy a web application firewall rule that blocks uamgetfile values containing ../, ..\, or URL-encoded equivalents
Restrict web server file system permissions so that the PHP process cannot read sensitive files outside the WordPress root
Remove or rename the plugin's controller endpoints until an update can be applied

bash

# Example ModSecurity rule blocking traversal in uamgetfile
SecRule ARGS:uamgetfile "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" \
  "id:1026183520,phase:2,deny,status:403,\
   msg:'CVE-2026-18352 User Access Manager traversal attempt'"