CVE-2026-18352: WordPress User Access Manager Directory Traversal

Executive Summary

A High-severity directory traversal vulnerability (CVE-2026-18352) has been disclosed in the User Access Manager plugin for WordPress. All versions up to and including 2.3.15 are affected. The flaw exists in the uamgetfile parameter and allows unauthenticated attackers to read the contents of arbitrary files on the server — including sensitive configuration files and credentials.

CVSS Score: 7.5 (High)

The vulnerability requires no authentication and no user interaction, making it straightforward to exploit remotely. WordPress site owners running the affected plugin should update immediately.

Vulnerability Overview

Affected Versions

The User Access Manager plugin is a popular WordPress plugin used to manage user roles, restrict access to posts and pages, and create member-only sections. Its widespread deployment across WordPress sites amplifies the potential impact of this flaw.

Technical Details

The vulnerability exists in the way the plugin handles file download requests. The uamgetfile parameter, used to serve protected files to authorized users, fails to properly sanitize user-supplied path input. An attacker can craft a request using path traversal sequences (../) to navigate outside the intended directory and read files anywhere on the filesystem accessible to the web server process.

Attack Flow

1. Attacker identifies a WordPress site running User Access Manager <= 2.3.15
2. Attacker sends a crafted HTTP GET request with a traversal payload:
   ?uamgetfile=../../wp-config.php
3. Plugin processes the request without sanitizing the path
4. Server returns contents of the requested file
5. Attacker extracts database credentials, secret keys, and configuration data

Files at Risk

Remediation

Step 1: Update the Plugin

Update User Access Manager to the latest version through the WordPress admin dashboard:

Plugins > Installed Plugins > User Access Manager > Update Now

Or via WP-CLI:

wp plugin update user-access-manager
 
# Verify installed version
wp plugin get user-access-manager --field=version

Step 2: If Immediate Update Is Not Possible

1. Deactivate the plugin until a patch can be applied
2. Block requests containing traversal sequences at the WAF or web server level:

# Nginx — block directory traversal attempts
if ($request_uri ~* "\.\./") {
    return 403;
}

# Apache — mod_rewrite rule
RewriteCond %{QUERY_STRING} \.\./ [NC]
RewriteRule .* - [F]

Step 3: Check for Signs of Exploitation

# Search web server access logs for uamgetfile traversal attempts
grep -i "uamgetfile" /var/log/nginx/access.log | grep "\.\."
 
# Check for abnormal access to wp-config.php via GET requests
grep "wp-config.php" /var/log/nginx/access.log
 
# Review recent plugin file reads in PHP logs
grep "uamgetfile" /var/log/php/error.log

Detection Indicators

Post-Remediation Checklist

1. Confirm the plugin is updated to the patched version
2. Review access logs for evidence of traversal attempts prior to patching
3. Rotate all secrets stored in wp-config.php — database password, secret keys, API keys
4. Regenerate WordPress salt keys via wp config shuffle-salts
5. Audit file permissions — ensure the web server cannot read sensitive files outside the webroot
6. Deploy a WAF (Wordfence, Sucuri, Cloudflare) to block future traversal attempts
7. Enable file integrity monitoring to detect unauthorized reads or changes

References

• NVD — CVE-2026-18352
• User Access Manager Plugin — WordPress.org

Related Reading

• WPvivid Backup Plugin Critical RCE (CVE-2026-1357)
• WordPress Modular DS Critical Flaw