WP User Manager for WordPress contains a missing authorization vulnerability (CWE‑862) that lets an attacker manipulate a user’s state, such as changing roles or account status, without proper checks. The flaw can elevate privileges or grant unauthorized rights to the attacker. The CVSS base score of 4.3 indicates a moderate risk.

All WordPress installations that have the WP User Manager plugin running any version up to and including 2.9.25 are susceptible. Because the plugin is widely used, dozens of sites worldwide may be impacted. The vulnerability covers all releases from the product’s inception through 2.9.25.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, so no current exploitation trend is reported. The attack vector is via the web interface; an attacker needs ability to send requests to the plugin’s endpoints. Though the flaw does not enable remote code execution, it grants unauthorized user state manipulation once the attacker can reach the affected site, potentially requiring an existing account or credentials. Based on the description, the exploit appears to be web‑based and requires no insider privileges beyond what an attacker can obtain through normal site access or compromised credentials.