{
 "id": "WPSEC-2026-0985",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0985/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0985/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0985/index.md",
 "title": "Restrict Usernames Emails Characters Plugin <= 5.0.3 - Unauthenticated Missing Authorization to Site-Wide Maintenance Mode (DoS) and Nicename Data Deletion via Bulk Nicename Update Actions",
 "description": "The Restrict Usernames Emails Characters plugin for WordPress is vulnerable to unauthorized modification and loss of data via the bulk user_nicename update and process-removal actions in all versions up to, and including, 5.0.3, due to missing capability checks and nonce verification in the val() function (hooked to admin_init) and the wp__loaded() function (hooked to wp_loaded). This makes it possible for unauthenticated attackers to put the whole site into the plugin's maintenance mode, which returns a 503 error to every visitor and administrator for about ten minutes and can be repeated, to empty the plugin's custom author-slug (nicename) table, and to delete the stored state of a running nicename update process.",
 "plugin": {
  "slug": "restrict-usernames-emails-characters",
  "name": "Restrict Usernames Emails Characters Plugin",
  "full_name": "Restrict Usernames Emails Characters",
  "wordpress_org": "https://wordpress.org/plugins/restrict-usernames-emails-characters/",
  "advisories_url": "https://wpsec.com/vuln/plugin/restrict-usernames-emails-characters/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/restrict-usernames-emails-characters"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.2,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.1",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.1"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.1",
 "remediation": "Update to 5.1 or later.",
 "fix_released": "2026-10-13T23:13:17+00:00",
 "published": "2026-10-15T08:49:41+00:00",
 "updated": "2026-10-15T08:16:10.330490+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0985/",
  "https://plugins.svn.wordpress.org/restrict-usernames-emails-characters/tags/5.1/",
  "https://wordpress.org/plugins/restrict-usernames-emails-characters/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/restrict-usernames-emails-characters",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-15"
 }
}