# WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.24 - Unauthenticated Site Access Restriction Bypass via Password Reset Page URL Prefix

- **ID:** WPSEC-2026-1006
- **Plugin:** WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory (`wp-user-manager`), https://wordpress.org/plugins/wp-user-manager/
- **Affected versions:** from 2.8.2 before 2.9.25
- **Fixed in:** 2.9.25 (Update to 2.9.25 or later.)
- **Severity:** Low 3.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-288
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-15)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-user-manager
- **Fix released:** 2026-10-14
- **Published:** 2026-10-15
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1006/

## Description

The WP User Manager plugin for WordPress is vulnerable to a bypass of its "Prevent site access to visitors" protection via the password reset page exemption in versions 2.8.2 up to, and including, 2.9.24. This is due to wpum_prevent_entire_site() exempting any request whose URL merely begins with the password reset page's permalink, without checking which page WordPress actually serves. This makes it possible for unauthenticated attackers to view content such as child pages of the password reset page, or other pages reached through extra query arguments or matching plain-permalink IDs, on sites set up to be private when the site access restriction is enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1006/
- https://plugins.svn.wordpress.org/wp-user-manager/tags/2.9.25/
- https://wordpress.org/plugins/wp-user-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1006/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.