An improper access control flaw in the WP User Manager WordPress plugin allows an attacker to abuse privileges. The vulnerability is triggered when a user bypasses the normal permission checks that should restrict access to sensitive functions, enabling escalation of privileges within the site. This flaw is identified as CWE-284 and can allow a non-privileged user to gain elevated access, potentially compromising site integrity and confidentiality.

The vulnerability impacts the WP User Manager plugin for WordPress, versions 2.9.20 and earlier. Any WordPress site that has installed one of these versions is susceptible unless the plugin has been updated. The issue is mitigated by installing any release post‑2.9.20.

With a CVSS-base score of 6.5, this moderate‑severity flaw presents a tangible risk. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, indicating no known exploitation yet. Based on the description, the likely attack vector is an authenticated user with a non‑privileged role attempting to invoke privileged functionality; the attacker would need to adjust role permissions or exploit an existing elevated role. The absence of remote code execution does not diminish the urgency of applying the patch.