WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.24 - Unauthenticated Site Access Restriction Bypass via Password Reset Page URL Prefix
- ID
- WPSEC-2026-1006
- Plugin
- WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory (wp-user-manager)
- Affected
- from 2.8.2 before 2.9.25
- Remediation
- Update to 2.9.25 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-288
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-15
- Attack surface
- WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory on WPSec AttackSurface
- Fix released
- Published
Description
The WP User Manager plugin for WordPress is vulnerable to a bypass of its "Prevent site access to visitors" protection via the password reset page exemption in versions 2.8.2 up to, and including, 2.9.24. This is due to wpum_prevent_entire_site() exempting any request whose URL merely begins with the password reset page's permalink, without checking which page WordPress actually serves. This makes it possible for unauthenticated attackers to view content such as child pages of the password reset page, or other pages reached through extra query arguments or matching plain-permalink IDs, on sites set up to be private when the site access restriction is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1006/
- https://plugins.svn.wordpress.org/wp-user-manager/tags/2.9.25/
- https://wordpress.org/plugins/wp-user-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS