CVE-2026-83560 — New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass

CVE-2026-83560

New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass PUBLISHED

Description (CNA)

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.

Affected (CNA)

Vendor / product	Versions
Unknown / New User Approve	affected 3.1.0 before 3.2.10

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/dc48141c-c7d3-485e-9470-88f5e24a701f/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.