This vulnerability arises from missing authorization checks in the WordPress WP User Manager plugin. Incorrectly configured access control security levels allow an attacker to interact with the plugin’s administrative features without appropriate permissions. The flaw is a classic example of CWE-862, resulting in an unauthorized user potentially viewing, editing or deleting user accounts, roles or site settings.

The affected product is the WP User Manager plugin for WordPress. Versions from the initial release through 2.10.4 contain the defect; updating to 2.10.5 or later removes the vulnerability. WordPress sites that are running any of these versions and have the plugin installed are at risk.

The CVSS score of 5.3 indicates a moderate impact, and no EPSS score is available. The vulnerability has not appeared in the CISA KEV catalog. Because the flaw stems from improper access checks, a web‑based attack that sends crafted requests to the plugin’s endpoints is the most likely exploitation vector. An attacker with basic knowledge of the site’s URL structure could leverage the missing authorization to execute privileged actions without needing administrative credentials.