CVE-2026-103085 WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability
An attacker can exploit improper access control in the WP User Manager plugin to escalate privileges within a WordPress site.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-103085?
CVE-2026-103085 is a medium-severity vulnerability in WP User Manager, published on 5 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20.
Weakness: CWE-284
Which versions are affected by CVE-2026-103085?
How do I fix CVE-2026-103085?
No fix has been published for CVE-2026-103085 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-103085 being exploited?
There is no known exploitation of CVE-2026-103085 in the wild and no public exploit code.
Sources
Also known as GHSA-3376-m9vc-5g23.