PT-2026-5067 · WordPress · New User Approve

Deadbee · Published 2026-01-28 · Updated 2026-02-02 · CVE-2026-0832

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions New User Approve plugin for WordPress versions up to and including 3.2.2

Description The New User Approve plugin for WordPress is susceptible to unauthorized data access and modification. This is due to a missing capability check on multiple REST API endpoints. An unauthenticated attacker can approve or deny user accounts, retrieve sensitive user information such as emails and roles, and force logout of privileged users. The affected API endpoints include those used for user approval and account management. The vulnerable functionality allows manipulation of user account status and access to user data without proper authorization.

Recommendations Update the New User Approve plugin to a version beyond 3.2.2.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-0832

Affected Products

New User Approve

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2026-0832 · Security Note
• https://twitter.com/CVEnew/status/2016414563801989346 · Twitter Post
• https://plugins.trac.wordpress.org/browser/new-user-approve/trunk/includes/end-points/mobile-api.php#L60 · Note
• https://t.me/cveNotify/150090 · Telegram Post
• https://plugins.trac.wordpress.org/browser/new-user-approve/tags/3.2.1/includes/end-points/mobile-api.php#L60 · Note
• https://twitter.com/cracbot/status/2018278293708165357 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3442291%40new-user-approve&new=3442291%40new-user-approve&sfp_email=&sfph_mail= · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/f86a69ab-2fc5-4c84-872b-929dbec429cd?source=cve · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3425140%40new-user-approve&new=3425140%40new-user-approve&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/new-user-approve/tags/3.2.1/includes/end-points/mobile-api.php#L24 · Note
• https://t.me/CVEtracker/43110 · Telegram Post
• https://plugins.trac.wordpress.org/browser/new-user-approve/trunk/includes/end-points/mobile-api.php#L24 · Note