CVE-2026-110527: WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass

Q: Who is exposed to this issue?

Sites using WP User Manager versions before 2.9.20 and relying on payment-gated registration are exposed. An unauthenticated visitor can create a functional WordPress account when the payment step subsequently fails.

Q: What does an attacker need to exploit it?

The attacker does not need an existing account or authentication. They need access to a payment-gated registration flow where the post-account-creation payment step can fail or be bypassed.

Q: Are accounts created through the failed payment flow usable?

Yes. The issue description states that the plugin leaves behind functional WordPress accounts instead of rolling them back after payment failure.

Q: How can I determine whether my site may be affected?

Check the installed WP User Manager version. Versions before 2.9.20 may be affected if the site uses payment-gated registration.

Published Oct 17, 2026

Updated

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.

Affected Software

1 affected component

WP User Manager WP User Manager<2.9.20

Event History

Oct 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using WP User Manager versions before 2.9.20 and relying on payment-gated registration are exposed. An unauthenticated visitor can create a functional WordPress account when the payment step subsequently fails.

What does an attacker need to exploit it?

The attacker does not need an existing account or authentication. They need access to a payment-gated registration flow where the post-account-creation payment step can fail or be bypassed.

Are accounts created through the failed payment flow usable?

Yes. The issue description states that the plugin leaves behind functional WordPress accounts instead of rolling them back after payment failure.

How can I determine whether my site may be affected?

Check the installed WP User Manager version. Versions before 2.9.20 may be affected if the site uses payment-gated registration.

CVE-2026-110527: WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are accounts created through the failed payment flow usable?

How can I determine whether my site may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Are accounts created through the failed payment flow usable?

How can I determine whether my site may be affected?