The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to modify the plugin's export field configuration stored in the uiewp_export_field option, controlling which user fields such as password hashes are included in CSV exports and how columns are mapped during imports.
| Vendor | Product | Versions |
|---|---|---|
| wordpress | user management | 0 |
Updated severity to CRITICAL and noted that the vulnerability is actively exploited.
Initial creation
