PT-2026-5067 · WordPress · New User Approve

Deadbee · Publicado 2026-01-28 · Atualizado 2026-02-02 · CVE-2026-0832

Positive Technologies (AI Summary)

CVSS v3.1

7.3

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions New User Approve plugin for WordPress versions up to and including 3.2.2

Description The New User Approve plugin for WordPress is susceptible to unauthorized data access and modification. This is due to a missing capability check on multiple REST API endpoints. An unauthenticated attacker can approve or deny user accounts, retrieve sensitive user information such as emails and roles, and force logout of privileged users. The affected API endpoints include those used for user approval and account management. The vulnerable functionality allows manipulation of user account status and access to user data without proper authorization.

Recommendations Update the New User Approve plugin to a version beyond 3.2.2.

Correção

Missing Authorization

Enumeração de Fraquezas

CWE-862

Identificadores relacionados

CVE-2026-0832

Produtos afetados

New User Approve

Referências · 12

• https://twitter.com/CVEnew/status/2016414563801989346 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/new-user-approve/trunk/includes/end-points/mobile-api.php#L60 · Nota
• https://t.me/cveNotify/150090 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-0832 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/new-user-approve/tags/3.2.1/includes/end-points/mobile-api.php#L60 · Nota
• https://twitter.com/cracbot/status/2018278293708165357 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442291%40new-user-approve&new=3442291%40new-user-approve&sfp_email=&sfph_mail= · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/f86a69ab-2fc5-4c84-872b-929dbec429cd?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3425140%40new-user-approve&new=3425140%40new-user-approve&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/new-user-approve/tags/3.2.1/includes/end-points/mobile-api.php#L24 · Nota
• https://t.me/CVEtracker/43110 · Publicação no Telegram
• https://plugins.trac.wordpress.org/browser/new-user-approve/trunk/includes/end-points/mobile-api.php#L24 · Nota