What the vulnerability does
01Description
The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the plugin's export field configuration stored in the uiewp_export_field option, controlling which user fields such as password hashes are included in CSV exports and how columns are mapped during imports.
Explanation of Vulnerability in Simple Terms
02Summary
User Management versions 1.2 and earlier lack proper authorization checks, allowing unauthenticated attackers to modify data through network requests. The vulnerability does not expose sensitive information or disrupt service availability, but enables unauthorized changes to user records or settings. Administrators should update to a version newer than 1.2 as soon as a patch is available.
What an attacker can do
03Attacker Capabilities
Modify user data or settings without authentication.
Potential impact on your site
04Site Impact
Unauthorized changes to user accounts, profiles, or permissions without admin knowledge or consent.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
July 8, 2026
CVE published
July 8, 2026
Record updated
