The User Access Manager WordPress plugin fails to enforce its configured access restrictions on REST API requests, allowing any unauthenticated user to read the content of posts, pages, and custom post types that are meant to be visible only to specific user groups. This flaw results in the leakage of confidential or sensitive information that the site administrators have deliberately restricted. Affected systems are WordPress installations that use the User Access Manager plugin with a version older than 2.3.15. The vulnerability applies to all supported content types handled by the plugin and to any custom post types that the plugin protects through its group-based settings. The risk is high because the attack does not require authentication; an unauthenticated attacker merely needs to send a REST API request. No CVSS score is provided, and EPSS is not available, but the vulnerability is listed as not in the CISA KEV catalog. Nonetheless, an attacker can easily exploit the flaw by querying public API endpoints and retrieving otherwise restricted data.

Affected systems are WordPress sites that have the User Access Manager plugin installed at a version prior to 2.3.15. The plugin is an optional add-on to WordPress, so the vulnerability exists in any WordPress site relying on this plugin to restrict content visibility. No specific WordPress core version is mentioned; the issue is confined to the plugin itself.

The vulnerability has no publicly disclosed CVSS score, but it does not require authentication. An attacker can send arbitrary REST API requests to endpoints that expose post, page, or custom post content and retrieve full post body, metadata, and custom fields that are intended for restricted groups. Because the plugin’s permission checks are bypassed, the impact can include disclosure of proprietary, personal, or sensitive data. The lack of authentication or rate limiting allows automated exploitation from any IP address. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, yet the attack surface includes every public WordPress site using the plugin.