Unauthorized Data Access in New User Approve Plugin for WordPress

CVE-2026-0832

What is CVE-2026-0832?

The New User Approve plugin for WordPress experiences significant security risks due to a lack of capability checks on several REST API endpoints. This vulnerability allows unauthorized individuals to manipulate user accounts by approving or denying registrations without proper authentication. Additionally, attackers can access sensitive user information, including email addresses and roles, and even enforce logouts of legitimate users, thereby compromising the integrity of the site's user management. All users of affected versions, including those up to and including version 3.2.2, should update to the latest version to mitigate these risks.

References