CVE-2026-94079: WP User Manager Auth Bypass Vulnerability

CVE-2026-94079 Overview

CVE-2026-94079 is a broken access control vulnerability affecting the WP User Manager plugin for WordPress in versions up to and including 2.9.19. The flaw allows unauthenticated attackers to reach functionality that should require authorization, resulting in limited integrity impact on affected sites. The weakness is classified under CWE-862: Missing Authorization and is exploitable over the network without user interaction.

Critical Impact

Unauthenticated attackers can invoke protected plugin functionality on any WordPress site running WP User Manager <= 2.9.19, modifying data that should be restricted to authorized users.

Affected Products

• WP User Manager plugin for WordPress, versions <= 2.9.19
• WordPress sites with the vulnerable plugin installed and active
• All hosting environments running the affected plugin version

Discovery Timeline

• 2026-09-23 - CVE-2026-94079 published to the National Vulnerability Database (NVD)
• 2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-94079

Vulnerability Analysis

The WP User Manager plugin exposes one or more endpoints that fail to enforce proper authorization checks before executing sensitive actions. An unauthenticated remote attacker can send crafted HTTP requests directly to these endpoints and trigger operations that should only be available to privileged users. Because the attack requires no credentials and no user interaction, exploitation can be fully automated across large numbers of exposed WordPress sites.

The impact is limited to integrity: the vulnerability permits modification of data or state within the plugin's scope, but does not directly expose confidential information or cause service disruption. Refer to the Patchstack Vulnerability Report for endpoint-level details.

Root Cause

The root cause is missing authorization ([CWE-862]) on plugin request handlers. The affected code paths do not verify the caller's capabilities or role before performing privileged operations. Standard WordPress protections such as current_user_can() capability checks or nonce validation are either absent or improperly applied on the vulnerable endpoints.

Attack Vector

The attack vector is network-based and unauthenticated. An attacker sends an HTTP or HTTPS request to a vulnerable WP User Manager endpoint on the target WordPress site. Because no authentication token, session cookie, or user interaction is required, the request is processed and the underlying action is executed with elevated effective privilege.

No verified public exploit code has been published for this issue at the time of writing. See the Patchstack advisory for further technical context.

Detection Methods for CVE-2026-94079

Indicators of Compromise

• Unauthenticated HTTP requests to WP User Manager plugin endpoints under /wp-admin/admin-ajax.php, /wp-json/, or plugin-specific routes originating from unexpected IP addresses.
• Unexpected changes to user profile data, meta fields, or plugin configuration entries with no corresponding administrator session in access logs.
• New or modified user records created without matching authenticated wp-login.php activity.

Detection Strategies

• Correlate web server access logs with WordPress audit logs to identify plugin actions executed without a preceding authenticated session.
• Deploy web application firewall (WAF) rules that flag requests to WP User Manager endpoints from clients lacking valid authentication cookies.
• Track the installed plugin inventory across WordPress sites and alert on any host running WP User Manager version <= 2.9.19.

Monitoring Recommendations

• Enable verbose logging on WordPress admin-ajax and REST API routes to capture caller identity, IP address, and parameters.
• Monitor for anomalous spikes in requests to plugin endpoints, which often indicate mass scanning against WordPress vulnerabilities.
• Forward WordPress and web server logs to a centralized analytics platform for retention, correlation, and alerting.

How to Mitigate CVE-2026-94079

Immediate Actions Required

• Update WP User Manager to a version later than 2.9.19 on all WordPress instances as soon as a patched release is available.
• Inventory every WordPress site in the environment and confirm the running plugin version against the fixed release.
• Restrict administrative and plugin endpoints to trusted networks where feasible, using WAF or reverse proxy rules.

Patch Information

Refer to the Patchstack Vulnerability Report for WP User Manager for the current fixed version and vendor guidance. Apply the update through the WordPress plugin manager or via automated update tooling once the patched release is confirmed.

Workarounds

• Deactivate the WP User Manager plugin until a patched version can be installed if the plugin's functionality is not business-critical.
• Apply a virtual patch through a WAF that blocks unauthenticated requests to the affected plugin endpoints.
• Enforce IP allow-listing on /wp-admin/ and plugin REST routes to limit exposure to trusted administrative networks.

# Configuration example: block unauthenticated access to WP User Manager endpoints
# Example nginx snippet - adjust the location pattern to match the vulnerable route
location ~* /wp-json/wpum/ {
    if ($http_cookie !~* "wordpress_logged_in_") {
        return 403;
    }
}