Skip to content
CVE PROGRAM SOURCE RECORD8.8 High

CVE-2026-88827

Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

Description

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Unknown Disable Users

Default version status: unknown

  • 0 to ≤ 1.0.5affected

References