{"id":"CVE-2026-110523","kind":"vulnerability","aliases":["CVE-2026-110523"],"related":[],"title":"WP User Manager: paid registration grants admin role without payment","description":"The WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.","summary":"In WP User Manager before 2.9.26, disconnecting the payment gateway leaves a published paid registration form still assigning its configured role. An unauthenticated visitor can register and receive an administrator-equivalent role without paying.","severity":"high","cvss":8.1,"epss":0.00299,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wp-user-manager"],"not_affected_if":["no-privileged-registration-role","paid-registration-unused","wp-user-manager-2.9.26-or-later"],"how_to_check":"- Check the installed WP User Manager version in the WordPress plugins screen or with `wp plugin get wp-user-manager --field=version`\n- In the plugin's paid registration settings, look for published registration forms whose configured role is privileged while no payment gateway is connected","fix":"- Update WP User Manager to `2.9.26` or later\n- Until updated, unpublish paid registration forms that assign privileged roles, or disconnect and remove them","status":"open","published_at":"2026-10-21T06:16:47+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:05:56+00:00","updated_at":"2026-10-25T03:05:56+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:05:56Z","model":"claude-haiku-5-5","output":{"fix":"- Update WP User Manager to `2.9.26` or later\n- Until updated, unpublish paid registration forms that assign privileged roles, or disconnect and remove them","reach":"internet","title":"WP User Manager: paid registration grants admin role without payment","impact":"high","summary":"In WP User Manager before 2.9.26, disconnecting the payment gateway leaves a published paid registration form still assigning its configured role. An unauthenticated visitor can register and receive an administrator-equivalent role without paying.","category":"package","nicknames":[],"who_cares":["wordpress","wp-user-manager","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Anonymous visitor becomes site administrator-equivalent without paying","analyst_note":"Check the NVD entry and plugin changelog for the exact trigger and whether any other setup is required beyond gateway disconnection.","how_to_check":"- Check the installed WP User Manager version in the WordPress plugins screen or with `wp plugin get wp-user-manager --field=version`\n- In the plugin's paid registration settings, look for published registration forms whose configured role is privileged while no payment gateway is connected","needs_analyst":true,"not_affected_if":["paid-registration-unused","no-privileged-registration-role","wp-user-manager-2.9.26-or-later"],"who_is_affected":"Sites running WP User Manager before 2.9.26 that use the paid registration feature and have a published registration form assigning a privileged role. Sites that do not use paid registration, or whose forms assign only low-privilege roles, are not exposed in the same way. The sources do not say whether the flaw needs any particular payment gateway configuration beyond disconnection.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000651,"input_tokens":3376,"output_tokens":626,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-110523':13A,16A '-2026':12A,15A '2.9.26':31B,68C 'admin':7A 'administr':56B,109C 'administrator-equival':55B,108C 'allow':98C 'assign':43B,94C 'capabl':76C 'complet':113C 'configur':45B,96C 'continu':92C 'cve':11A,14A 'disconnect':32B,85C 'equival':57B,110C 'forc':79C 'form':41B,91C 'gate':118C 'gateway':35B,83C 'grant':6A 'host':20B 'immedi':104C 'keep':71C 'leav':36B 'manag':3A,25B,29B,64C 'meant':116C 'obtain':105C 'packag':17B 'paid':4A,39B,74C,89C 'paid-registr':73C 'pay':60B 'payment':10A,34B,82C,115C 'plugin':66C 'privileg':107C 'publish':38B,88C 'receiv':53B 'regist':51B,102C 'registr':5A,40B,75C,90C 'restrict':77C 'role':8A,46B,58B,97C,111C 'self':19B 'self-host':18B 'still':42B 'unauthent':48B,99C 'user':2A,24B,28B,63C,100C 'visitor':49B 'without':9A,59B,112C 'wordpress':21B,65C 'wp':1A,23B,27B,62C 'wp-user-manag':22B","nicknames":[],"mitigations":[],"who_affected":"Sites running WP User Manager before 2.9.26 that use the paid registration feature and have a published registration form assigning a privileged role. Sites that do not use paid registration, or whose forms assign only low-privilege roles, are not exposed in the same way. The sources do not say whether the flaw needs any particular payment gateway configuration beyond disconnection.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:47+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110523","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110523","severity":null,"published_at":"2026-10-21T06:16:47+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-110523","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-110523","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}