WP User Manager: Missing authorization (broken access control)
Summary
The WordPress plugin WP User Manager up to and including version 2.10.4 contains a missing authorization check (CWE-862). An attacker can access functions or data that should be restricted. The CVSS vector requires no privileges and no user interaction, so the flaw can be reached over the internet, but only low confidentiality impact is scored and the affected function is not disclosed.
Affected
- WP User Manager (WordPress plugin) from all versions through 2.10.4
Fixed in
- Fixed in version 2.10.5 (CVE record: unaffected from 2.10.5)
Workaround
- Unknown. No vendor-published workaround found. Updating to 2.10.5 is the fix.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV (per OffSeq and Strix).
- Public proof of concept: unconfirmed.
Our recommendation
- Check whether WP User Manager is installed and confirm the version.
- Update to version 2.10.5 or later, in the next maintenance window or sooner if the site holds member data or allows public registration.
- Review user data and access logs for unusual access if the site was exposed before the update.
- Monitor for further advisories on this plugin, as it has had similar access-control issues before.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-124413 www.cve.org
- Patchstack advisory patchstack.com
- OffSeq Radar: CVE-2026-124413 radar.offseq.com
- Strix: CVE-2026-124413 www.strix.ai
- VulDB 435751 vuldb.com
- WP User Manager on WordPress.org wordpress.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:47.
Original description (NVD)
Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.10.4.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.