CVE-2026-83560 Overview
CVE-2026-83560 affects the New User Approve WordPress plugin in versions before 3.2.10. The plugin fails to properly verify authentication on a set of integration REST API routes when the integration is unconfigured. Unauthenticated attackers can invoke these routes to retrieve personal data belonging to registered users, including user ID, username, email address, and registration date. The flaw exposes user directories on affected WordPress sites without requiring credentials or user interaction.
Critical Impact
Unauthenticated remote attackers can enumerate registered WordPress users and harvest their email addresses, enabling targeted phishing, credential stuffing, and account takeover follow-on attacks.
Affected Products
- New User Approve WordPress plugin versions prior to 3.2.10
- WordPress sites running the plugin with unconfigured integrations
- Any WordPress installation exposing the plugin's REST API routes
Discovery Timeline
- 2026-09-30 - CVE-2026-83560 published to NVD
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-83560
Vulnerability Analysis
The vulnerability is an authentication bypass on REST API endpoints registered by the New User Approve plugin for third-party integrations. When the integration feature is not configured, the affected REST routes skip authentication checks entirely instead of denying access. This creates an information disclosure path [CWE-862] that any unauthenticated HTTP client can reach.
The exposed endpoints return structured JSON containing user records. Each record includes the user ID, WordPress username, email address, and account registration date. Attackers can iterate through the response to build a complete roster of site accounts.
Root Cause
The plugin's REST route registration does not enforce a permission_callback that returns false when the integration state is unconfigured. Instead of treating the missing configuration as a hard deny, the route handler falls through and returns user data. This is a missing authorization defect rather than a broken credential check.
Attack Vector
An attacker sends unauthenticated HTTP GET requests to the vulnerable REST API paths exposed by the plugin. No session cookie, nonce, or API key is required. The server responds with a JSON payload containing personally identifiable information for registered users. The harvested email addresses feed downstream phishing and credential-stuffing campaigns against the site's user base.
Because no verified proof-of-concept code is published, refer to the WPScan Vulnerability Report for endpoint specifics and payload structure.
Detection Methods for CVE-2026-83560
Indicators of Compromise
- Unauthenticated HTTP GET requests to /wp-json/ paths registered by the New User Approve plugin returning 200 OK with user records
- Web server access logs showing repeated REST API calls from a single IP enumerating plugin integration routes
- Spikes in outbound response size on plugin REST endpoints when no administrator sessions are active
Detection Strategies
- Inspect WordPress access logs for requests to the plugin's REST namespace originating without valid authentication headers or cookies
- Alert on JSON responses from the plugin's integration routes that contain user_email or user_login fields served to unauthenticated clients
- Correlate email-harvest patterns with subsequent login failures on wp-login.php to identify credential-stuffing follow-on activity
Monitoring Recommendations
- Enable REST API request logging on WordPress and forward logs to a centralized SIEM for baselining and anomaly detection
- Monitor the plugin version inventory across all managed WordPress sites and flag any instance running a version earlier than 3.2.10
- Track outbound response payload sizes on plugin REST routes to catch bulk enumeration attempts
How to Mitigate CVE-2026-83560
Immediate Actions Required
- Upgrade the New User Approve plugin to version 3.2.10 or later on every WordPress instance
- Audit registered user accounts and notify users whose email addresses may have been exposed
- Review WordPress and web server logs for prior unauthenticated access to the plugin's REST endpoints
Patch Information
The vendor has addressed the issue in New User Approve version 3.2.10. The fix enforces authentication on the integration REST routes regardless of integration configuration state. Refer to the WPScan Vulnerability Report for the fixed version reference.
Workarounds
- Deactivate the New User Approve plugin until the site can be updated to version 3.2.10 or later
- Block unauthenticated requests to the plugin's REST API namespace at the web application firewall or reverse proxy layer
- Restrict access to /wp-json/ endpoints by source IP where the site's operational model allows it
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
