What is GHSA-x37j-q2h4-mfmw?

GHSA-x37j-q2h4-mfmw is a security advisory published by GitHub Security Advisories with Medium severity. The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to...

Which CVE IDs does GHSA-x37j-q2h4-mfmw cover?

GHSA-x37j-q2h4-mfmw covers the following CVE IDs: CVE-2026-18035. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-x37j-q2h4-mfmw?

GHSA-x37j-q2h4-mfmw has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-x37j-q2h4-mfmwMediumCVSS 5.3

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to...

Vendor

GitHub Security Advisories

Published

August 12, 2026

Last Modified

August 12, 2026

🔗 CVE IDs covered (1)

CVE-2026-18035 →

📋 Description

The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-18035
https://wpscan.com/vulnerability/9c5cae62-4c4c-434b-ae40-4654b257803f
https://github.com/advisories/GHSA-x37j-q2h4-mfmw