CVE-2026-12097 - WordPress User Management <= 1.2 - Missing Auth to Unauthenticated Plugin Settings Modification
Posted: Wed Jul 08, 2026 8:32 am
CVE ID: CVE-2026-12097
Published: July 8, 2026
Description: The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the plugin's export field configuration stored in the uiewp_export_field option, controlling which user fields such as password hashes are included in CSV exports and how columns are mapped during imports.
Severity: 0.0 | NA
More Information:
https://cvefeed.io/vuln/detail/CVE-2026-12097
Published: July 8, 2026
Description: The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the plugin's export field configuration stored in the uiewp_export_field option, controlling which user fields such as password hashes are included in CSV exports and how columns are mapped during imports.
Severity: 0.0 | NA
More Information:
https://cvefeed.io/vuln/detail/CVE-2026-12097