CVE-2026-107423 WP User Manager CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP User Manager plugin, specifically those using versions up to 2.9.22, should assess their exposure and take necessary actions to mitigate the vulnerability. This includes reviewing current plugin versions, assessing exposure, and applying updates or compensating controls as necessary.

Why it matters

The CVE-2026-107423 vulnerability in the WordPress WP User Manager plugin requires verification of exposure and potential updates to prevent exploitation. Defenders should review current plugin versions, assess exposure, and apply necessary updates or compensating controls.

• Verification of plugin version and potential update to a secure version is necessary to prevent exploitation.
• Adjusting access control configurations may be required to mitigate the vulnerability.
• Monitoring for suspicious activity related to the plugin is recommended.

Technical summary

The WP User Manager plugin for WordPress, versions up to 2.9.22, contains a Missing Authorization vulnerability. This vulnerability, classified under CWE-122, allows for Exploiting Incorrectly Configured Access Control Security Levels. The issue has been assigned a CVSS score of 4.3, indicating medium severity. The vulnerability is exploitable via network, requires low attacker privileges, and no user interaction.

Defensive priority

Defenders should prioritize verifying the version of the WP User Manager plugin in use and ensuring it is updated to a version beyond 2.9.22 if possible. This involves reviewing current plugin versions, assessing exposure, and applying updates or compensating controls as necessary.

Recommended defensive actions

• Verify the version of the WP User Manager plugin in use and update to a version beyond 2.9.22 if possible.
• Review and adjust access control configurations for the plugin to prevent exploitation.
• Monitor for any suspicious activity related to the plugin.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and CVSS score. However, there is limited information on exploitation or specific impacts, suggesting a need for further verification and assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.