Vulnerabilities / WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory / WPSEC-2026-2239
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.10.3 - Unauthenticated Sensitive Information Exposure via Profile URLs
Low 3.7
CWE-200Fixed in 2.10.4
- ID
- WPSEC-2026-2239
- Plugin
- WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory (wp-user-manager)
- Affected
- all versions before 2.10.4
- Remediation
- Update to 2.10.4 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-200
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory on WPSec AttackSurface
- Fix released
- Published
Description
The WP User Manager plugin for WordPress is vulnerable to Sensitive Information Exposure via public profile URLs in all versions up to, and including, 2.10.3. This is due to the wpum_get_profile_url() function building profile links from the user's login name or nickname even when that value is an email address. This makes it possible for unauthenticated attackers to obtain users' email addresses from profile links when the profile permalink structure is set to username or nickname and affected users have an email address as their login or nickname.
References
- https://wpsec.com/vuln/WPSEC-2026-2239/
- https://plugins.svn.wordpress.org/wp-user-manager/tags/2.10.4/
- https://wordpress.org/plugins/wp-user-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS