CVE-2026-110527 PUBLISHED

WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass

Assigner: WPScan
Reserved: 14.10.2026 Published: 17.10.2026 Updated: 17.10.2026

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.

Product Status

Vendor Unknown
Product WP User Manager
Versions Default: unaffected
  • affected from 2.9 to 2.9.20 (excl.)

Credits

  • Sanjorn Keeratirungsan finder
  • WPScan coordinator

References

Problem Types

  • CWE-284 Improper Access Control CWE