CVE-2026-18345: WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admininit hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no currentusercan() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpumsettings option via wpumupdateoption()/updateoption(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with Subscriber-level access or higher can exploit it. The attacker must be able to complete their own Stripe Connect OAuth flow and invoke the resulting callback on the target site.
Are sites affected if untrusted users can access wp-admin?
Yes. The vulnerable callback is handled through the admin_init hook, which runs when any authenticated user reaches /wp-admin/, including Subscribers; administrator privileges are not required.
What is the practical impact of a successful exploit?
The attacker can replace the configured Stripe publishable key, secret key, gateway mode, and connected Stripe account ID. Subsequent Stripe payments can then be routed to the attacker’s Stripe account.
How can administrators check for compromise?
Review the WP User Manager Stripe settings for unexpected publishable or secret keys, gateway mode changes, or an unfamiliar connected Stripe account ID. Also verify that recent Stripe payments are being received by the intended Stripe account.