CVE-2026-0832 describes a missing capability check in the New User Approve WordPress plugin's REST API endpoints, affecting all versions up to 3.2.2. This authorization bypass enables unauthenticated attackers to manipulate user account approval status, retrieve sensitive user information including emails and roles, and force logout of privileged users. The vulnerability is categorized under CWE-862 and has a high CVSS score of 7.3, reflecting the potential for unauthorized data access and modification without requiring authentication.

Exploitation of this vulnerability can lead to unauthorized approval or denial of user accounts, disclosure of sensitive user information such as email addresses and roles, and forced logout of privileged users. These impacts can compromise the integrity and confidentiality of user management within affected WordPress sites. The vulnerability does not require authentication, increasing the risk of exploitation by remote attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected REST API endpoints if possible, and monitor for unusual user approval activities. Avoid using the affected plugin versions in sensitive environments. Follow updates from the plugin vendor or WordPress security advisories for official patches or mitigations.