WP User Manager contains a missing‑authorization flaw that allows attackers to exploit incorrectly configured access control levels. The vulnerability permits users with lower privileges to perform actions normally restricted to administrators, such as viewing or modifying sensitive user data. The primary impact is the unauthorized access to privileged administrative functions, which can lead to data exposure or tampering.

The WP User Manager plugin for WordPress is affected. All installations using any version up to and including 2.9.22 are vulnerable. The plugin may appear on any WordPress site that has installed the WP User Manager plugin, regardless of the broader WordPress version.

The CVSS score of 4.3 indicates moderate severity, while no EPSS data is available and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is a web request to the plugin’s administrative endpoints, which expects a higher privilege level than the user actually possesses. Because the flaw arises from incorrect access control settings, it can be exploited by any authenticated user who is assigned a role lower than an administrator but still has network access to the site. The exploitation effort is low, assuming the attacker can send crafted HTTP requests.