CVE-2026-18035
User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API
- State
- Published
- Severity
- 5.3 Medium
- Published
- Aug 12, 2026
- Updated
- Aug 12, 2026
- Reserved
- Jul 28, 2026
Description
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.3 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
Weaknesses
- CWE-862 Missing Authorization
Affected Products
| Product | Versions |
|---|---|
User Access ManagerUnknown |
|
References
- https://wpscan.com/vulnerability/9c5cae62-4c4c-434b-ae40-4654b257803f/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.