CVE-2026-18035CWE-862broken-access-control

CVE-2026-18035

Medium · published August 12, 2026

CVSS v3.1
5.3
EPSS
0%
Percentile
24.1
In the wild
Unconfirmed
What it is

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00323 · 24.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-08-12T10:19Z
References (1)
https://wpscan.com/vulnerability/9c5cae62-4c4c-434b-ae40-4654b257803f/ · [email protected]
EPSS history
Timeline
  • 12 AUG 06:00Z
    User Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API
    cvelistv5