CVE-2026-88827 — Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

CVE-2026-88827

Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords PUBLISHED

Description (CNA)

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.

Affected (CNA)

Vendor / product	Versions
Unknown / Disable Users	affected 0 through 1.0.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/1120d99a-9853-4b41-a2ce-d4909b19aea1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.