Known vulnerabilities in New User Approve

WordPress user approval plugin to moderate registrations. Approve or deny real users and prevent fake signups to control who registers on site.

10Reported vulnerabilities

7.3Highest CVSS score

3.2.8Latest version

20,000+Active installs

What to do now

Update New User Approve to 3.2.9 or later. 10 of these have a fixed version available. Updating resolves them.

Plugin last updated: May 21, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
CVE-2022-1625	Medium 4.3	0.4%	Before 2.4	`2.4`	June 27, 2022
CVE-2026-0832	High 7.3	0.3%	0 to 3.2.2 (inclusive)	`3.2.3`	January 28, 2026
CVE-2023-50902	Medium 6.1	0.2%	2.5.1 and earlier	`2.5.2`	December 26, 2023
WF-b8e3f779-9d25-4525-a827-8ce743bd889e	Medium 6.1	—	2.4 and earlier	`2.4.1`	May 30, 2022
CVE-2026-28163	Medium 5.3	0.2%	3.2.8 and earlier	`3.2.9`	August 20, 2026
CVE-2025-69063	Medium 5.3	0.3%	3.2.0 and earlier	`3.2.1`	February 11, 2026
CVE-2025-12770	Medium 5.3	0.3%	0 to 3.0.9 (inclusive)	`3.1.0`	November 19, 2025
CVE-2026-25390	Medium 4.3	0.3%	3.2.3 and earlier	`3.2.4`	March 20, 2026
CVE-2025-63030	Medium 4.3	0.1%	3.2.3 and earlier	`3.2.4`	November 8, 2025
CVE-2024-54323	Medium 4.3	0.3%	2.6.2 and earlier	`2.6.4`	December 11, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.