Junglewise Threat Intelligence

CVE-2026-12097: WordPress User Management authorization bypass in export configuration

CVE-2026-12097 · Severity: medium · CVSS 5.3 · Published 2026-07-08

Executive brief

The User Management plugin for WordPress, which helps administrators manage user data, contains a security flaw that allows unauthorized individuals to change how user data is exported and imported. An attacker could exploit this to include sensitive information, such as password hashes, in data exports or manipulate how data is mapped during imports. This could lead to the exposure of sensitive user credentials or the corruption of user records.

Technical details

The User Management plugin for WordPress (versions up to 1.2) suffers from a missing authorization check (CWE-862) in its handling of export and import configurations. Specifically, the plugin fails to verify if a user has the necessary permissions before allowing modifications to the 'uiewp_export_field' option. An unauthenticated remote attacker can exploit this via a network request to change which database fields are included in CSV exports or how columns are mapped during imports. This can be leveraged to exfiltrate sensitive fields like password hashes or disrupt user data integrity. The vulnerability is present in the plugin's model and main execution files.

Affected products

  • saadiqbal User Management up to, and including, 1.2

Timeline

  • 2026-07-08: advisory: NVD publication date

References