{"vulnerability": "CVE-2026-88827", "sightings": [{"uuid": "4261ece5-15cd-478e-8a55-a88823f34eab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-88827", "type": "seen", "source": "https://infosec.exchange/users/cve/statuses/117420954432260002", "content": "CVE-2026-88827 Disable Users <= 1.0.5 - Disabled Account Authentication Bypass via XML-RPC and Application Passwords The Disable Users WordPress plugin through 1.0.5 does not enforce its account-disabling control on all authentication paths, allowing the holder of an account an administrator has disabled to continue authenticating with the account's full privileges.\nhttps://www.cve.org/CVERecord?id=CVE-2026-88827https://wpscan.com/vulnerability/1120d99a-9853-4b41-a2ce-d4909b19aea1/#CVE_2026_88827#bot", "creation_timestamp": "2026-10-11T06:52:55.699199Z"}]}