CVE-2026-88827 HIGH 8.8
Published: 2026-10-11 07:17:27 UTC · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Categories: Web servers & CMS
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
Weakness: CWE-287