CVE-2026-18352

The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.

• CWE-22

• https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/Controller/BaseControllerTrait.php%3A22-50
• https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/Controller/Frontend/RedirectController.php%3A50-99%2C119-141%2C245-252
• https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/File/FileHandler.php%3A79-124%2C270-294
• https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/UserAccessManager.php%3A512-516
• https://plugins.trac.wordpress.org/changeset/3628895/user-access-manager
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4e88efe0-ffad-4d66-bb03-3f3a9dcbe5b1?source=cve

Published

Aug 2, 2026

Last Modified

Aug 3, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-18325The Forminator Forms – Contact Form, Payment Form & Custom F…7.2
• CVE-2026-1833The WaMate Confirm – Order Confirmation plugin for WordPress…5.3
• CVE-2026-1834The Ibtana – WordPress Website Builder plugin for WordPress …6.4
• CVE-2026-18344The Wp Responsive Thumbnail Slider plugin for WordPress is v…6.1
• CVE-2026-18348Missing authorization check in the upload_azure, upload_sftp…4.1
• CVE-2026-1835A vulnerability was identified in lcg0124 BootDo up to e93dd…4.3
• CVE-2026-18353PIA's `POST /v1/upload/sbom` endpoint accepts a Bearer JWT a…8.8
• CVE-2026-18357The WPC Order Tip for WooCommerce WordPress plugin before 3.…7.5
• CVE-2026-18358A flaw was found in gnome-remote-desktop as shipped in Red H…7.5
• CVE-2026-18359Server-side request forgery in the METS and IIIF import URI …8.5
• CVE-2026-1836The system stores the username and password from the login f…5.3
• CVE-2026-18360The IRIS web application in version 2.4.26 and possibly othe…7.6