CVE-2026-83560

New User Approve 3.1.0 - 3.2.9 - Unauthenticated PII Disclosure via Zapier API Key Bypass

The New User Approve WordPress plugin before 3.2.10 does not properly verify authentication on a set of integration REST API routes when the integration is unconfigured, allowing unauthenticated attackers to retrieve personal data (id, username, email address and registration date) of registered users.

Affected

New User Approve

CVSS v3.1 CNA

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

0.23% chance of exploitation in the next 30 days, 13th percentile

Published

2026-09-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/dc48141c-c7d3-485e-9470-88f5e24a701f/

References

• CVE Record
• NVD entry