CVE-2026-103085

MediumCVSS 6.5/10Last modified Oct 6, 2026

Description

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-284

Affected software

No affected versions have been published.

Timeline

Published: Oct 5, 2026
Last modified: Oct 6, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1030866.5Missing Authorization vulnerability in Stiofan UsersWP userswp allows Exploiting Incorrectly Configured Access Control Security Levels.This CVE-2026-1030877.1Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a remote attacker to c CVE-2026-1030887.5Handlebars.java before 4.5.5 allows directory traversal. In handlebars-springmvc 4.5.3 and 4.5.4, the path-containment fix for CVE-2026-6349 CVE-2026-1030908.8Missing Authentication for Critical Function (CWE-306) and Insufficiently Protected Credentials (CWE-522) in the control plane enrollment st CVE-2026-1030919.3Missing Authorization (CWE-862) and Initialization of a Resource with an Insecure Default (CWE-1188) in the MCP proxy (HandleStreamPassThrou CVE-2026-1030967.5API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensitive CVE-2026-1030977.5An API key is hardcoded and retrievable from the application package. Since Android applications can be reverse engineered, embedding sensit CVE-2026-1030987.5Transmission of a sensitive key in the URL over an unencrypted HTTP connection. The request is sent over HTTP rather than HTTPS, meaning th CVE-2026-1030997.5Pexip Infinity before 41.1 is affected by improper input validation in the media implementation that allows a remote attacker to trigger a s CVE-2026-10316.1IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 is vulnerable to cross-site scripting. T CVE-2026-1031007.5Pexip Infinity before 40.1 is affected by improper input validation in the signaling implementation that allows a malicious attacker to trig CVE-2026-1031017.5Pexip Infinity 30.0 through 40.x before 41.0 is affected by improper input validation in the web server that allows a malicious attacker to