CVE-2026-25390: 
WordPress vulnerability analysis and mitigation

CVE-2026-25390 is a Missing Authorization (Broken Access Control) vulnerability in the New User Approve WordPress plugin by Saad Iqbal. It allows authenticated attackers with low privileges to exploit incorrectly configured access control security levels. All versions up to and including 3.2.3 are affected. The vulnerability was published on March 25, 2026, and assigned by Patchstack. It carries a CVSS v3.1 base score of 6.5 (Medium) (Feedly, Patchstack).

The root cause is classified as CWE-862 (Missing Authorization) — the plugin fails to properly verify that a requesting user has the necessary permissions before executing sensitive actions related to user approval workflows. An authenticated attacker with low-level privileges can send crafted network requests to trigger privileged operations without proper authorization checks. The attack vector is network-based, requires no user interaction, and has low attack complexity, making it straightforward to exploit once an attacker has any authenticated foothold on the WordPress site (Feedly).

Successful exploitation results in a high availability impact — an attacker can disrupt or manipulate the user approval process, potentially causing denial of service to the user registration/approval workflow. There is no direct confidentiality or integrity impact identified in the CVSS scoring. In practice, abuse of the access control flaw could allow low-privileged users to interfere with pending user approvals, potentially blocking legitimate user registrations or manipulating account states on the affected WordPress site (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017%, indicating a very low probability of exploitation in the near term. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability requires low-privilege authentication, which somewhat limits opportunistic exploitation compared to unauthenticated flaws (Feedly).

Users should update the New User Approve plugin to a version beyond 3.2.3 as soon as a patched release is made available by the developer. In the interim, site administrators should restrict plugin access to trusted roles only and monitor user registration and approval logs for anomalous activity. Disabling the plugin entirely until a patch is available is a viable workaround for sites where the user approval workflow is not critical (Patchstack).