The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.23.

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22.

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20.

Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admininit hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no currentusercan() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpumsettings option via wpumupdateoption()/updateoption(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.