# WP Plugin Manager <= 1.4.16 - Authenticated (Subscriber+) Missing Authorization to Plugin Status Disclosure via REST API

- **ID:** WPSEC-2026-0508
- **Plugin:** WP Plugin Manager – Deactivate plugins per page (`wp-plugin-manager`), https://wordpress.org/plugins/wp-plugin-manager/
- **Affected versions:** from 1.4.0 before 1.4.17
- **Fixed in:** 1.4.17 (Update to 1.4.17 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-07)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-plugin-manager
- **Fix released:** 2026-10-06
- **Published:** 2026-10-07
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0508/

## Description

The WP Plugin Manager plugin for WordPress is vulnerable to unauthorized access in versions 1.4.0 up to, and including, 1.4.16. The permission callback of its recommended plugins REST API endpoints (htpm/v1) only checks whether the user is logged in, not whether the user can manage plugins. This makes it possible for authenticated attackers, with Subscriber-level access and above, to find out whether arbitrary plugins are installed on the site and whether each one is active or inactive. The plugin installation and activation endpoints are not affected, because they check the user's capabilities separately.

## References

- https://wpsec.com/vuln/WPSEC-2026-0508/
- https://plugins.svn.wordpress.org/wp-plugin-manager/tags/1.4.17/
- https://wordpress.org/plugins/wp-plugin-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0508/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.