Description
The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Disable Users | ≤ 1.0.5 | — |
References
- https://wpscan.com/vulnerability/1120d99a-9853-4b41-a2ce-d4909b19aea1/ exploit vdb-entry technical-description