Live › vulnerability › CVE-2026-110523
Go to dashboardIn WP User Manager before 2.9.26, disconnecting the payment gateway leaves a published paid registration form still assigning its configured role. An unauthenticated visitor can register and receive an administrator-equivalent role without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running WP User Manager before 2.9.26 that use the paid registration feature and have a published registration form assigning a privileged role. Sites that do not use paid registration, or whose forms assign only low-privilege roles, are not exposed in the same way. The sources do not say whether the flaw needs any particular payment gateway configuration beyond disconnection.
No product ranges from the sources yet.
wp plugin get wp-user-manager --field=version2.9.26 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
This page as .md · .json · in your agent: get_signal("CVE-2026-110523")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.