Vulnerabilidades do Saad Iqbal New User Approve
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Saad Iqbal New User Approve: 5 registro(s), com versões afetadas e correções.
CVE-2026-25390
Média · 6.5
CWE-862 25/03/2026
WordPress New User Approve plugin <= 3.2.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.3.
CVE-2025-69063
Alta · 8.6
CWE-862 20/02/2026
WordPress New User Approve plugin <= 3.2.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 3.2.0.
CVE-2026-0832
Alta · 7.3
CWE-862 28/01/2026
New User Approve <= 3.2.2 - Missing Authorization to Unauthenticated Arbitrary User Approval, Denial, and Information Disclosure
The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to approve or deny user accounts, retrieve sensitive user information including emails and roles, and force logout of privileged users.
CVE-2025-63030
Alta · 7.1
CWE-352 09/12/2025
WordPress New User Approve plugin <= 3.2.3 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery (CSRF) vulnerability in Saad Iqbal New User Approve new-user-approve allows Cross Site Request Forgery.This issue affects New User Approve: from n/a through <= 3.2.3.
CVE-2025-12770
Média · 5.3
CWE-200 19/11/2025
New User Approve <= 3.0.9 - Unauthenticated Sensitive Information Disclosure via Type Juggling
The New User Approve plugin for WordPress is vulnerable to unauthorized data disclosure in all versions up to, and including, 3.0.9 due to insufficient API key validation using loose equality comparison. This makes it possible for unauthenticated attackers to retrieve personally identifiable information (PII), including usernames and email addresses of users with various approval statuses via the Zapier REST API endpoints, by exploiting PHP type juggling with the api_key parameter set to "0" on sites where the Zapier API key has not been configured.