WordPress Plugin Vulnerabilities

User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API

Description

The plugin does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.

Proof of Concept

Affects Plugins

Plugin icon
user-access-manager
Fixed in 2.3.15

References

CVE
CVE-2026-18035

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Farid Narimanov
Submitter
Farid Narimanov
Submitter website
https://faridnarimanov.com
Verified
Yes
WPVDB ID
9c5cae62-4c4c-434b-ae40-4654b257803f

Timeline

Publicly Published
2026-08-10 (about 3 days ago)
Added
2026-08-10 (about 2 days ago)
Last Updated
2026-08-10 (about 2 days ago)

Other

Published
Title
Published
2025-04-01
Title
Shopper Approved Reviews 2.0 - 2.1 - Subscriber+ Arbitrary Options Update
Published
2024-06-18
Title
AliExpress Dropshipping with AliNext Lite < 3.3.7 - Missing Authorization via Several Functions
Published
2025-12-18
Title
Image Photo Gallery Final Tiles Grid < 3.6.8 - Missing Authorization to Authenticated (Contributor+) Gallery Management
Published
2025-11-17
Title
RestroPress < 3.2.3.6 - Missing Authorization
Published
2025-02-18
Title
WordPress Portfolio Builder – Portfolio Gallery <= 1.1.7 - Missing Authorization to Unauthenticated Portfolio Update