Vulnerability · Published Oct 17, 2026 · Assigned by WPScan
CVE-2026-110527WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass
Medium 5.3
In plain English
A medium-severity improper access control in WP User Manager from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 8% of all known vulnerabilities).
Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.2%top 92.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | WP User Manager | 2.9 – before 2.9.20 |
Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
References
- https://wpscan.com/vulnerability/a9368969-cc1c-48b7-aa39-94a4d3c50669/ exploit, vdb-entry, technical-description