{"id":"CVE-2026-88827","published":"2026-10-11T07:17:27.267","lastModified":"2026-10-13T20:36:00.850","description":"The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/1120d99a-9853-4b41-a2ce-d4909b19aea1/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Disable Users WordPress plugin fails to properly enforce account disabling across all authentication paths, allowing disabled administrators to maintain full access to their accounts. This represents a critical authorization bypass vulnerability where disabled users can continue using their privileges despite being explicitly disabled by administrators.","exploitability":"Exploitation is straightforward for any disabled user who retains valid credentials, requiring no special conditions or prerequisites beyond having access to the compromised account.","blast_radius":"The impact could be severe as disabled administrators retain full administrative privileges, potentially allowing attackers to maintain persistent access and perform privileged actions even after account disabling.","remediation":"Upgrade to version 1.0.6 or later of the Disable Users plugin to address this authorization bypass vulnerability.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","wordpress","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-13T08:54:59.227Z"}}