CVE-2026-18035

The User Access Manager WordPress plugin (versions before 2.3.15 ) is vulnerable to an unauthenticated restricted content disclosure via the REST API . The root cause is the plugin's failure to apply access restrictions to REST API requests, which allows attackers to read the content of posts , p...