Disable Users WordPress plugin: Authentication bypass for disabled accounts
Summary
The Disable Users WordPress plugin through version 1.0.5 does not enforce its account-disabling control on all authentication paths. A user whose account an administrator has disabled can keep authenticating with the account's full privileges, according to the WPScan title via XML-RPC and Application Passwords. Exploitation requires a previously valid account that has since been disabled, and the attacker must be able to reach the WordPress site over the network.
Affected
- Disable Users WordPress plugin (slug disable-users), versions 0 up to and including 1.0.5
- Vendor: Unknown
Fixed in
- Unknown. WPScan lists no known fix.
Workaround
- Remove or deactivate the plugin if it is not essential, after checking that the disabling function is not needed
- Do not rely on the plugin's disable setting for offboarding; change passwords, destroy sessions and revoke Application Passwords for affected accounts
- Restrict or disable XML-RPC if the site does not need it; test on a staging copy first, as these steps are not confirmed to close the bypass
Exploitation
- Not listed in CISA KEV
- No confirmed in-the-wild exploitation found in the reviewed sources
- CISA SSVC: exploitation none, automatable no
- Public proof of concept: unclear
- EPSS about 0.17% to 0.28% at the time of the records
Our recommendation
- Check whether the plugin is installed, which version is used, and whether its disable function is in use
- If it is in use, apply the workarounds and treat it as a priority-2 item
- Review accounts disabled via the plugin and revoke their sessions and Application Passwords
- Monitor logins by accounts that should be disabled and watch XML-RPC access logs
- Check the NVD record for current status, as it is listed as Deferred
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan vulnerability record wpscan.com
- OpenCVE CVE-2026-88827 app.opencve.io
- VulnCheck/Vulners VULNRICHMENT CVE-2026-88827 vulners.com
- Patchstack mirror record vulners.com
- OffSeq Radar CVE-2026-88827 radar.offseq.com
- GitHub Disable-Users repository (jaredatch) github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 20:36.
Original description (NVD)
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.