Quick answers
- Is CVE-2026-18035 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18035 being exploited in the wild.
- How severe is CVE-2026-18035?
- Medium severity, with a CVSS score of 5.3, published 12 August 2026.
- Which products and versions are affected?
- SegmentWare User Access Manager before 2.3.15.
- Is there a fix for CVE-2026-18035?
- A patch was published on 2026-08-12: Fixed in version 2.3.15 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18035 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-18035?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an access control bypass (CWE-862) where the User Access Manager plugin checks user permissions for direct web requests but not for REST API requests. An unauthenticated attacker can enumerate restricted posts via the /wp-json/wp/v2/posts endpoint and then retrieve full content (including title, body, and excerpt) from /wp-json/wp/v2/posts/{id} endpoints, bypassing all group-based access restrictions. The attack requires no authentication, user interaction, or plugin misconfiguration. The fix in version 2.3.15 applies access control checks to REST API responses, returning "Sorry you have no rights to view this entry!" for restricted content regardless of endpoint.
Affected products
- SegmentWare User Access Manager before 2.3.15
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: Fixed in version 2.3.15