Live › vulnerability › CVE-2026-110527
Go to dashboardThe WP User Manager WordPress plugin creates a WordPress account during payment-gated registration and does not delete it when the payment step fails. An unauthenticated visitor can end up with a working account without paying.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the WP User Manager plugin before 2.9.20 that use payment-gated registration. Sites without paid registration flows or without this plugin can skip it.
No product ranges from the sources yet.
2.9.202.9.20 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.
This page as .md · .json · in your agent: get_signal("CVE-2026-110527")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.