CVE-2026-83560

MediumCVSS 5.3/10Last modified Sep 30, 2026

Description

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200

Affected software

VendorProductVersions
UnknownNew User Approve>= 3.1.0, < 3.2.10

References

Timeline

Published
Sep 30, 2026
Last modified
Sep 30, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-835617.2The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via ElemCVE-2026-835626.5Contributor Cross Site Scripting (XSS) in WCFM Marketplace <= 3.8.2 versions.CVE-2026-835637.8Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.CVE-2026-835647.0Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-835655.5Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.CVE-2026-835667.0Use after free in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.CVE-2026-835677.8Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.CVE-2026-835687.8Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.CVE-2026-835697.8Heap-based buffer overflow in HID Parser Library allows an authorized attacker to elevate privileges locally.CVE-2026-83577.8LibreOffice Calc compiles cell formulas when opening a spreadsheet. A heap buffer overflow existed when compiling a very long formula made uCVE-2026-835707.8Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.CVE-2026-835715.5Null pointer dereference in Windows Audio Service allows an authorized attacker to disclose information locally.
CVE-2026-83560: Medium severity, CVSS 5.3 | Vulnix