CVE-2026-0832 affects the New User Approve plugin for WordPress, specifically versions up to and including 3.2.2. This vulnerability, stemming from a missing capability check in multiple REST API endpoints, allows unauthenticated attackers to approve or deny user accounts, access sensitive user data like emails and roles, and force privileged users to log out. Rated as High severity with a CVSS score of 7.3, it presents a low-complexity attack vector with potential for significant impact on confidentiality, integrity, and availability. There is currently no evidence of active exploitation, and no public exploit code (Metasploit, Nuclei, ExploitDB) is available; community discussion is minimal, with no media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
| Saadiqbal | New User Approve | >= 0, <= 3.2.2CNA affecteddefault unaffected |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.