{
 "id": "WPSEC-2026-0508",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0508/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0508/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0508/index.md",
 "title": "WP Plugin Manager <= 1.4.16 - Authenticated (Subscriber+) Missing Authorization to Plugin Status Disclosure via REST API",
 "description": "The WP Plugin Manager plugin for WordPress is vulnerable to unauthorized access in versions 1.4.0 up to, and including, 1.4.16. The permission callback of its recommended plugins REST API endpoints (htpm/v1) only checks whether the user is logged in, not whether the user can manage plugins. This makes it possible for authenticated attackers, with Subscriber-level access and above, to find out whether arbitrary plugins are installed on the site and whether each one is active or inactive. The plugin installation and activation endpoints are not affected, because they check the user's capabilities separately.",
 "plugin": {
  "slug": "wp-plugin-manager",
  "name": "WP Plugin Manager",
  "full_name": "WP Plugin Manager – Deactivate plugins per page",
  "wordpress_org": "https://wordpress.org/plugins/wp-plugin-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-plugin-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-plugin-manager"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "1.4.0",
    "from_inclusive": true,
    "to": "1.4.17",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 1.4.0 before 1.4.17"
  ]
 },
 "introduced_in": "1.4.0",
 "fixed_in": "1.4.17",
 "remediation": "Update to 1.4.17 or later.",
 "fix_released": "2026-10-06T05:43:56+00:00",
 "published": "2026-10-07T11:46:41+00:00",
 "updated": "2026-10-07T10:53:27.696150+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0508/",
  "https://plugins.svn.wordpress.org/wp-plugin-manager/tags/1.4.17/",
  "https://wordpress.org/plugins/wp-plugin-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-plugin-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-07"
 }
}