WP Plugin Manager <= 1.4.16 - Authenticated (Subscriber+) Missing Authorization to Plugin Status Disclosure via REST API
- ID
- WPSEC-2026-0508
- Plugin
- WP Plugin Manager – Deactivate plugins per page (wp-plugin-manager)
- Affected
- from 1.4.0 before 1.4.17
- Remediation
- Update to 1.4.17 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-07
- Attack surface
- WP Plugin Manager on WPSec AttackSurface
- Fix released
- Published
Description
The WP Plugin Manager plugin for WordPress is vulnerable to unauthorized access in versions 1.4.0 up to, and including, 1.4.16. The permission callback of its recommended plugins REST API endpoints (htpm/v1) only checks whether the user is logged in, not whether the user can manage plugins. This makes it possible for authenticated attackers, with Subscriber-level access and above, to find out whether arbitrary plugins are installed on the site and whether each one is active or inactive. The plugin installation and activation endpoints are not affected, because they check the user's capabilities separately.
References
- https://wpsec.com/vuln/WPSEC-2026-0508/
- https://plugins.svn.wordpress.org/wp-plugin-manager/tags/1.4.17/
- https://wordpress.org/plugins/wp-plugin-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS