CVE-2026-18352

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.

• CWE-22

• https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/Controller/BaseControllerTrait.php%3A22-50
• https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/Controller/Frontend/RedirectController.php%3A50-99%2C119-141%2C245-252
• https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/File/FileHandler.php%3A79-124%2C270-294
• https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/UserAccessManager.php%3A512-516
• https://plugins.trac.wordpress.org/changeset/3628895/user-access-manager
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4e88efe0-ffad-4d66-bb03-3f3a9dcbe5b1?source=cve

Published

Aug 2, 2026

Last Modified

Aug 12, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18346The TikTok plugin for WordPress is vulnerable to authorizati…5.3
• CVE-2026-18347The Kirki – Freeform Page Builder, Website Builder & Customi…4.3
• CVE-2026-18348Missing authorization check in the upload_azure, upload_sftp…4.1
• CVE-2026-18349Improper protection against voltage and clock glitches vulne…7.3
• CVE-2026-1835A vulnerability was identified in lcg0124 BootDo up to e93dd…4.3
• CVE-2026-18351The Drag and Drop File Upload for Elementor Forms plugin for…9.8
• CVE-2026-18353PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT a…8.8
• CVE-2026-18355A heap buffer overflow flaw was found in the SASL I/O layer …7.5
• CVE-2026-18356The Limit Login Attempts Reloaded WordPress plugin before 3.…3.7
• CVE-2026-18357The WPC Order Tip for WooCommerce WordPress plugin before 3.…7.5
• CVE-2026-18358A flaw was found in gnome-remote-desktop as shipped in Red H…7.5
• CVE-2026-18359Server-side request forgery in the METS and IIIF import URI …8.5