Authentication Bypass in Disable Users Plugin for WordPress
CVE-2026-88827
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 11 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-88827?
The Disable Users plugin for WordPress, up to version 1.0.5, contains a critical flaw where its account-disabling functionality is not properly enforced across all authentication pathways. As a result, users whose accounts have been disabled by administrators can still log in, retaining full privileges. This vulnerability poses a significant risk as it allows unauthorized access to sensitive areas of the WordPress site, potentially leading to data breaches or malicious exploits.
Affected Version(s)
Disable Users 0 <= 1.0.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.