What is CVE-2026-0832?

CVE-2026-0832 is a high-severity vulnerability in Saadiqbal New User Approve, classified under Missing Authorization. CVSS score: 7.3/10. Published 2026-01-28.

How severe is CVE-2026-0832?

High severity. CVSS v3 base score is 7.3 out of 10.

Auth bypass in Saadiqbal New User Approve

CVE-2026-0832

The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 3.2.2. This makes it possible for unauthenticated attackers to approve or deny user accounts, retrieve sensitive user information including emails and roles, and force logout of privileged users.

Vulnerability class: Broken Access Control

EPSS: 0.003 (24.7th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.3 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L.

Affected products

Saadiqbal New User Approve — versions 0

Weakness classification (CWE)

CWE-862 — Missing Authorization

References

Frequently asked questions

What is CVE-2026-0832?: CVE-2026-0832 is a high-severity vulnerability in Saadiqbal New User Approve, classified under Missing Authorization. CVSS score: 7.3/10. Published 2026-01-28.
How severe is CVE-2026-0832?: High severity. CVSS v3 base score is 7.3 out of 10.