CVE-2026-110523: WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP User Manager WordPress pluginto a version that resolves this vulnerability.Fixed in 2.9.26
Event History
Frequently Asked Questions
Which installations are exposed to exploitation?
Installations running WP User Manager versions 2.9.21 through 2.9.25 are exposed when Stripe is disconnected and a paid registration form remains published with a privileged administrator-equivalent role configured.
What does an attacker need to exploit this issue?
The attacker only needs to access the published registration form. They can register without authenticating or completing the payment that would normally gate assignment of the configured role.
What should be done if updating is not immediately possible?
Reconnect the payment gateway or unpublish the affected paid registration form so it cannot continue assigning the configured privileged role while payment restrictions are not enforced. Update WP User Manager to version 2.9.26 when possible.
How can I determine whether the vulnerable condition is already present?
Check whether the plugin is running a version before 2.9.26, Stripe has been disconnected, and any published paid registration form is configured to assign an administrator-equivalent role. That combination creates the described exposure.