WP User Manager: Privilege escalation via paid registration after gateway disconnect
Summary
WP User Manager versions 2.9.21 to 2.9.25 keep a paid registration form active after the payment gateway is disconnected and still assign the configured role to new users. An unauthenticated attacker can register and immediately obtain an administrator-equivalent role without paying. Successful exploitation gives full control of the WordPress site, including content, plugins and stored customer data.
Affected
- WP User Manager 2.9.21 to before 2.9.26
- Condition: payment gateway disconnected and a paid registration form still published
Fixed in
- Version 2.9.26 (fix to be verified in the WordPress.org changelog)
Workaround
- Unpublish paid registration forms or disable public registration until the update is applied (own suggestion, not from a vendor source)
Exploitation
- Not known to be exploited; not listed in CISA KEV
- CISA SSVC: exploitation none, automatable no
- No public proof of concept found
Our recommendation
- Check whether WP User Manager is installed and which version runs on each site
- Update to 2.9.26 or later after confirming the fix in the changelog
- Check whether paid registration forms are published and whether the payment gateway is connected
- Review administrator accounts for unexpected additions
- Severity is disputed (CVSS 8.1 in the record, 5.3 at VulDB); prioritise sites where paid registration was configured
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- WPScan advisory CVE-2026-110523 wpscan.com
- OpenCVE CVE-2026-110523 app.opencve.io
- Hol.org CVE-2026-110523 hol.org
- VulDB CVE-2026-110523 vuldb.com
- Vulners VulnRichment CVE-2026-110523 vulners.com
- Patchstack via Vulners vulners.com
- GitHub tracker issue 2720 github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 18:11.
Original description (NVD)
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.