User Management

User Management has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 7.6, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high.

The most common weakness is Incorrect Privilege Assignment, behind 1 of the records (33%). Other recurring categories include Missing Authorization, Unrestricted Upload Of File With Dangerous Type.

Every one of the 3 issues recorded for User Management has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, one record each. User Management is installed on roughly 60 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.8.8.

Strategic Overview

Avg CVSSHigh

7.6/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all User Management vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2025-22736

User Management <= 1.1 - Authenticated (Subscriber+) Privilege Escalation

Read the full analysis

Vulnerability Records

3 records


2026-07-07 16:31	User Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification User Management <= 1.2	`CVE-2026-12097`	5.3 Medium	haitam_lz	Yes
2025-01-14 00:00	User Management <= 1.1 - Authenticated (Subscriber+) Privilege Escalation User Management <= 1.1	`CVE-2025-22736`	8.8 High	ardias	Yes
2024-11-13 00:00	User Management <= 1.1 - Authenticated (Subscriber+) Arbitrary File Upload User Management <= 1.1	`CVE-2024-52403`	8.8 High	stealthcopter	Yes

Showing 1–3 of 3 reports

Latestv1.3

User Management

Author

Saad Iqbal

0.0(0)

0/100

Last Updated

2026-07-17 (2mo ago)

Active Installs

60+

Downloads

3,367

Requires WP

6.7+

Requires PHP

7.0+

Tested up to

WP 6.8.8

Created

2021-04-13 (6y ago)

User Management for WordPress gives you the power to manage users and their data from a centralized dashboard Import/Export/Update user data by roles and filters. User Management for WordPress gives admin the ability to import or export user details on a website. You can easily import or export WP users, roles, and capabilities via CSV file in just a few clicks. Note: This plugin is also compatible with the WooCommerce plugin Features Import user details via CSV file. Import WP user roles & capabilities via CSV file. Export details of WP users to a CSV file. Export specific users by roles and capabilities. Export specific users in general. Export roles and capabilities only. Export profile information with the user metadata (your custom field in CSV). Create/update user details easily. REQUIREMENTS WordPress 5.0+ PHP 7.0+ Documentation Click Here to read complete documentation of the product. The documentation includes a step-by-step installation and configuration guide, system specifications, troubleshooting, and support. Major Update This is major update of our plugin please make sure you have take backup before updating this plugin.

View on WordPress.org