CVE-2026-18035 in User Access Manager Plugin
Summary
by MITRE • 08/12/2026
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/12/2026
The User Access Manager WordPress plugin vulnerability represents a critical access control flaw that undermines fundamental security assumptions within WordPress ecosystems. This issue affects versions prior to 2.3.15 and demonstrates how plugin developers may inadvertently create security gaps by failing to implement consistent access controls across all API endpoints. The vulnerability stems from the plugin's improper handling of REST API requests, where it fails to enforce the same user group restrictions that typically apply to traditional web requests. This oversight creates a dangerous scenario where authenticated access controls are bypassed for API-based content retrieval, exposing protected content to unauthorized users.
The technical implementation flaw occurs when the plugin processes REST API calls without validating whether the requesting user possesses appropriate permissions to access specific content. This represents a classic case of insufficient input validation and access control enforcement as described in CWE-284 Access Control Bypass. The vulnerability specifically impacts posts, pages, and custom post types that have been configured with group-based restrictions, allowing any unauthenticated attacker to retrieve this content through direct API calls. The flaw operates at the application layer where the plugin's access control logic is not consistently applied across different request pathways, creating an inconsistent security posture.
Operationally, this vulnerability poses significant risks to organizations relying on User Access Manager for content protection and user access control. Attackers can exploit this weakness to systematically harvest protected content, potentially including sensitive business information, confidential communications, or proprietary data that should only be accessible to authorized user groups. The impact extends beyond simple information disclosure as it undermines the entire user management and content access control framework that administrators have implemented. This vulnerability aligns with ATT&CK technique T1213 Data from Information Repositories, where adversaries extract sensitive data through legitimate application interfaces.
The exploitation of this vulnerability requires minimal technical expertise and can be automated using standard REST API testing tools, making it particularly dangerous in environments where WordPress is widely deployed. Organizations may experience cascading security impacts as attackers gain access to content that was previously protected by group membership restrictions. The vulnerability also highlights the importance of comprehensive security testing across all application interfaces, including modern API endpoints that are increasingly prevalent in web applications. Effective mitigation requires immediate plugin updates to version 2.3.15 or later, along with thorough security audits of other plugins and themes that may exhibit similar access control bypass issues.
Organizations should implement additional monitoring and logging mechanisms to detect unauthorized REST API access patterns that could indicate exploitation attempts. Security teams must also review their existing access control policies and verify that all content management systems properly enforce restrictions across all communication channels. The vulnerability serves as a reminder of the critical importance of maintaining up-to-date security practices and conducting regular vulnerability assessments to identify potential bypass scenarios in complex web application environments.