WP User Manager – User Profile Builder & Membership <= 2.9.21 - Unauthenticated Sensitive Information Exposure via REST API
- ID
- WPSEC-2026-0396
- Plugin
- WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory (wp-user-manager)
- Affected
- from 2.9.8 before 2.9.22
- Remediation
- Update to 2.9.22 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-284
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP User Manager – User Profile Builder & Membership on WPSec AttackSurface
- Fix released
- Published
Description
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to Sensitive Information Exposure via the REST API in versions 2.9.8 up to, and including, 2.9.21. This is due to the "Prevent site access to visitors" (lock_complete_site) setting only redirecting logged-out visitors on regular front-end requests and exempting REST API requests from that check. This makes it possible for unauthenticated attackers to read content the site owner intended to restrict to logged-in users, such as published posts, pages, media and the list of post authors, through the REST API on sites where the "Prevent site access to visitors" setting is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0396/
- https://plugins.svn.wordpress.org/wp-user-manager/tags/2.9.22/
- https://wordpress.org/plugins/wp-user-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS