CVE-2026-83560 New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass
Unauthenticated attackers can retrieve personal user data via REST API routes in the New User Approve WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-83560?
CVE-2026-83560 is a medium-severity vulnerability in Unknown New User Approve, published on 30 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.
Weakness: CWE-200
Which versions are affected by CVE-2026-83560?
How do I fix CVE-2026-83560?
No fix has been published for CVE-2026-83560 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-83560 being exploited?
There is no known exploitation of CVE-2026-83560 in the wild and no public exploit code.
Sources
Also known as GHSA-h3cp-h7xg-mwjx.