CVE-2026-12097 is an authorization bypass vulnerability in the saadiqbal User Management WordPress plugin affecting all versions up to and including 1.2. The plugin fails to properly verify user authorization before allowing modification of the uiewp_export_field option, which controls the fields included in CSV exports and column mappings during imports. This can be exploited by unauthenticated attackers to alter export configurations, potentially exposing sensitive user data such as password hashes. The vulnerability is categorized under CWE-862 (Missing Authorization). No official patch or remediation guidance is currently available.

An unauthenticated attacker can modify the export field configuration of the plugin, potentially controlling which user data fields are included in CSV exports. This could lead to unauthorized exposure or manipulation of sensitive user information, including password hashes. The vulnerability does not impact confidentiality directly but affects the integrity of the plugin's export configuration. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the WordPress installation and monitor for unauthorized changes to plugin options. Avoid using the vulnerable plugin version in environments where sensitive user data exposure is a concern.