User Admin Simplifier
User Admin Simplifier has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of August 2026. Their average CVSS score is 4.3, and the most serious one scores 4.3 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (100%).
The one issue recorded for User Admin Simplifier has a vendor fix available, so running the current release closes it.
All of these findings were reported by 有馬 龍成. User Admin Simplifier is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2026-11775User Admin Simplifier <= 3.0.0 - Cross-Site Request Forgery
Read the full analysisVulnerability Records

User Admin Simplifier
Author
Adam Silverstein
Lets any Administrator simplify the WordPress Admin interface, on a per-user basis. Hide any specific menu or submenu (including in the admin bar) or hide the admin bar entirely. Menu control modes User Admin Simplifier offers three menu control modes: Per-user only – the default mode. Configure menu, submenu, and admin bar visibility for each individual user. This is the original behavior and is unchanged. Role-based only – configure menu, submenu, and admin bar visibility (and menu order) once per WordPress role. Every user inherits the settings for their role. Users with multiple roles get the union of all their roles’ settings for visibility, while menu order comes from the primary role only. Role-based with per-user overrides – applies the role defaults, but lets you override each menu item per user with an Inherit / Show / Hide control. Existing per-user configurations are preserved. Existing installs see no change unless an Administrator switches modes. Regardless of mode, the User Admin Simplifier settings page (under Tools) always remains accessible to Administrators, so you can never lock yourself out. Development Requirements PHP 7.4 or higher Composer (for managing PHP dependencies) Node.js and npm (for building JavaScript assets) Setup Clone the repository Run composer install to install PHP dependencies Run npm install to install JavaScript dependencies Run npm run build to build the React application Code Quality This plugin uses PHPStan for static analysis to ensure code quality and type safety. To run PHPStan: composer install (first time only) npm run phpstan Or directly with PHP: php vendor/bin/phpstan analyse The project is configured to run PHPStan at level 3 for improved reliability and maintainability. Testing The plugin includes PHP unit tests, end-to-end (E2E) tests, and visual regression tests. PHP Unit Tests Run PHP unit tests: npm run test:php End-to-End Tests E2E tests use Playwright to test the plugin in a real WordPress environment. Setup: Install dependencies: npm install Start WordPress environment: npm run env:start Run tests: npm run test:e2e See tests/e2e/README.md for detailed documentation on running and writing E2E tests. Available E2E test commands: npm run env:start – Start WordPress test environment npm run env:stop – Stop WordPress test environment npm run test:e2e – Run E2E tests in headless mode npm run test:e2e:headed – Run E2E tests with visible browser npm run test:e2e:ui – Run E2E tests in interactive UI mode npm run test:e2e:debug – Run E2E tests in debug mode npm run test:e2e:report – View test report Visual Regression Testing This plugin uses Playwright for automated visual regression testing to catch unintended visual changes during development. Prerequisites: Node.js 18 or higher Playwright browsers installed (Chromium by default) Initial Setup: Install dependencies: npm install Install Playwright browsers: npx playwright install --with-deps chromium Build the application: npm run build Running Visual Tests: Run all visual tests: npm run test:visual Run tests in UI mode (interactive): npm run test:visual:ui Update baseline snapshots: npm run test:visual:update How It Works: Visual regression tests capture screenshots of the UI and compare them to baseline images. If there are visual differences, the tests will fail and generate a report showing what changed. This helps detect: Unintended layout changes CSS styling issues Component rendering problems Responsive design regressions Test Coverage: The visual tests cover: – Initial app state (no user selected) – User selector dropdown – Full menu interface with user selected – Menu list with toggle functionality – Admin bar options – Save and reset buttons – Checked menu states – Expandable submenus – Responsive layouts (tablet and mobile views) Updating Snapshots: When intentional UI changes are made, update the baseline snapshots: npm run test:visual:update Review the changes in the tests/visual/app.spec.js-snapshots/ directory to ensure they match your intended changes. CI Integration: Visual regression tests run automatically on GitHub Actions for all pull requests and pushes to main/master branches. Test reports and snapshots are uploaded as artifacts for review. Running All Tests Run all tests (PHP unit tests + E2E tests): npm run test
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C