{
 "id": "WPSEC-2026-1006",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1006/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1006/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1006/index.md",
 "title": "WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.24 - Unauthenticated Site Access Restriction Bypass via Password Reset Page URL Prefix",
 "description": "The WP User Manager plugin for WordPress is vulnerable to a bypass of its \"Prevent site access to visitors\" protection via the password reset page exemption in versions 2.8.2 up to, and including, 2.9.24. This is due to wpum_prevent_entire_site() exempting any request whose URL merely begins with the password reset page's permalink, without checking which page WordPress actually serves. This makes it possible for unauthenticated attackers to view content such as child pages of the password reset page, or other pages reached through extra query arguments or matching plain-permalink IDs, on sites set up to be private when the site access restriction is enabled.",
 "plugin": {
  "slug": "wp-user-manager",
  "name": "WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory",
  "full_name": "WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory",
  "wordpress_org": "https://wordpress.org/plugins/wp-user-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-user-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-user-manager"
 },
 "type": "AUTHBYPASS",
 "cwe": [
  "CWE-288"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.7,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.8.2",
    "from_inclusive": true,
    "to": "2.9.25",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.8.2 before 2.9.25"
  ]
 },
 "introduced_in": "2.8.2",
 "fixed_in": "2.9.25",
 "remediation": "Update to 2.9.25 or later.",
 "fix_released": "2026-10-14T10:14:03+00:00",
 "published": "2026-10-15T10:51:54+00:00",
 "updated": "2026-10-14T14:17:58.712816+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1006/",
  "https://plugins.svn.wordpress.org/wp-user-manager/tags/2.9.25/",
  "https://wordpress.org/plugins/wp-user-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-user-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-15"
 }
}