CVE-2026-88827

Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords

The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.

Affected

Disable Users

CVSS v3.1 CNA

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.28% chance of exploitation in the next 30 days, 19th percentile

Published

2026-10-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/1120d99a-9853-4b41-a2ce-d4909b19aea1/

References

• CVE Record
• NVD entry