CVE-2026-110523
CVE-2026-110523 · WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
CVSS 8.1 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
wp user manager
- Versions du logiciel
- ≥ 2.9.21, < 2.9.26: Concernée (semver)
Mettez à jour vers 2.9.26