Vulnerability · Published Jan 28, 2026 · Assigned by Wordfence

CVE-2026-0832New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure

High 7.3

In plain English

A high-severity missing authorization in New User Approve from saadiqbal. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)7.3High

Exploit odds (30 days)0.4%top 71.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to approve or deny user accounts, retrieve sensitive user information including emails and roles, and force logout of privileged users.

Affected products (as reported)

Vendor	Product	Versions
saadiqbal	New User Approve	0 – through 3.2.2

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

In plain English

Official description

Affected products (as reported)

References