CVE-2026-88827

Summary

The Disable Users WordPress plugin fails to properly enforce account disabling across all authentication paths, allowing disabled administrators to maintain full access to their accounts. This represents a critical authorization bypass vulnerability where disabled users can continue using their privileges despite being explicitly disabled by administrators.

Exploitability

Exploitation is straightforward for any disabled user who retains valid credentials, requiring no special conditions or prerequisites beyond having access to the compromised account.

Blast radius

The impact could be severe as disabled administrators retain full administrative privileges, potentially allowing attackers to maintain persistent access and perform privileged actions even after account disabling.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.6 or later of the Disable Users plugin to address this authorization bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.