The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| User Access Manager Plugin | — | Update user-access-manager plugin to version 2.3.15, or a newer patched version | Aug 17, 2026 | Aug 10, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub