CVE-2026-83560CWE-200information-disclosure
CVE-2026-83560
Medium · published September 30, 2026
What it is
The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.
The record
Technical detail
- CVSS v3.1
- 5.3 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00232 · 13.3th percentile
- Weakness
- CWE-200 · Exposure of Sensitive Information to an Unauthorized Actor
- Published
- 2026-09-30T10:17Z
References (1)
EPSS history
Timeline