Authorization Bypass Vulnerability in User Management Plugin for WordPress

CVE-2026-12097

What is CVE-2026-12097?

The User Management plugin for WordPress contains a significant security flaw that allows unauthenticated attackers to bypass authorization checks. This vulnerability arises due to improper verification of user permissions, enabling malicious actors to modify critical export field configurations stored within the plugin. As a result, they can control which user data, including sensitive information like password hashes, is included in CSV exports. This issue affects all versions up to and including 1.2, highlighting the importance of updating to secure configurations and protecting user data.

References