High · published January 28, 2026
⚡🚨 Unauthenticated access? That's right! The New User Approve plugin for WordPress lets attackers waltz right in, bypassing security and manipulating user data without breaking a sweat. Think of it like an unmonitored guest list at a high-profile party—anyone can stroll in, make changes, and even kick out VIPs, all without a proper check at the door! This vulnerability could lead to catastrophic consequences, from unauthorized approvals or denials of user accounts to the exposure of sensitive user information like emails and roles. An attacker could even force privileged users out of their accounts, creating chaos and undermining trust in your platform!
Think of it like an unmonitored guest list at a high-profile party—anyone can stroll in, make changes, and even kick out VIPs, all without a proper check at the door! The issue stems from multiple REST API endpoints lacking critical capability checks, enabling unauthorized actions on user accounts in all versions of the plugin up to 3.2.2.
This vulnerability could lead to catastrophic consequences, from unauthorized approvals or denials of user accounts to the exposure of sensitive user information like emails and roles. An attacker could even force privileged users out of their accounts, creating chaos and undermining trust in your platform! To safeguard your site, update the New User Approve plugin to the latest version immediately. Additionally, review your user role permissions and ensure proper capability checks are in place for any related functionalities. You've got this! With a quick update, you’ll lock down your user data tighter than a vault! 🛡️