Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information. This is possible because when attachment_url_to_postid() returns 0 for a traversal path, the plugin falls back to the global post set by a valid ?attachment_id parameter supplied by the attacker, causing the access check to pass against a legitimate public attachment while the file streamed is the attacker-chosen path.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-18352 The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter paramete… https://www.cve.org/CVERecord?id=CVE-2026-18352
Post summary
The post reports a directory traversal flaw in WordPress User Access Manager plugin, citing the CVE ID and vulnerable parameter, but provides no PoC, exploit, patch, or active exploitation details.
🚨*CVE* CVE-2026-18352 The User Access Manager plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.3.15 via the 'uamgetfile' parameter paramete… https://www.cve.org/CVERecord?id=CVE-2026-18352 ----- Traducción: CVE-2026-18352 El … http://infoflow.cloud`
Post summary
The post discloses CVE-2026-18352, a directory traversal flaw in the WordPress User Access Manager plugin affecting all versions up to 2.3.15, and provides a link to the CVE record.
⚔️ ATTACKS CVE Notify: 🚨 [CVE-2026-18352](https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/C... https://plugins.trac.wordpress.org/browser/user-access-manager/tags/2.3.14/src/Controller/BaseControllerTrait.php%3A22-50 #InfoSec #CyberAttack #ThreatIn
Post summary
The post references CVE-2026-18352 with a link to the plugin source code but offers no proof‑of‑concept, exploit, patch, or detailed vulnerability data.