Executive brief
User Access Manager is a WordPress plugin that restricts access to posts, pages, and custom content based on user group membership. Before version 2.3.15, the plugin failed to enforce these access restrictions on REST API requests, allowing anyone on the internet to read restricted content without authentication. This could expose confidential or sensitive information that administrators intended to keep private.
Technical details
The vulnerability is an access control bypass (CWE-862) where the User Access Manager plugin checks user permissions for direct web requests but not for REST API requests. An unauthenticated attacker can enumerate restricted posts via the /wp-json/wp/v2/posts endpoint and then retrieve full content (including title, body, and excerpt) from /wp-json/wp/v2/posts/{id} endpoints, bypassing all group-based access restrictions. The attack requires no authentication, user interaction, or plugin misconfiguration. The fix in version 2.3.15 applies access control checks to REST API responses, returning "Sorry you have no rights to view this entry!" for restricted content regardless of endpoint.
Affected products
- SegmentWare User Access Manager before 2.3.15
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 2.3.15