CVE-2026-110523 in WP User Manager Plugin
Summary
by MITRE • 10/22/2026
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in WP User Manager versions prior to 2.9.26 represents a critical failure in access control logic within WordPress plugin architecture. The core issue stems from an improper enforcement of state-dependent restrictions, specifically regarding paid registration workflows. When the payment gateway integration is disconnected or becomes unavailable, the application fails to maintain the intended security boundary that restricts role assignment based on successful transaction completion. Instead of reverting to a default unprivileged state or blocking the action entirely, the system continues to process registration requests through the published form and assigns the configured user roles regardless of whether payment was actually processed. This behavior indicates a fundamental flaw in how the plugin validates prerequisites for privilege escalation during the account creation lifecycle.
From a technical perspective, this vulnerability allows an unauthenticated attacker to bypass authentication mechanisms by exploiting the logic gap between role assignment and payment verification. The attacker can submit registration forms configured with high-privilege roles, such as administrator or editor levels, without providing any valid credentials or completing financial transactions. Because the validation step that checks for successful payment completion is effectively disabled when the gateway is disconnected, the system trusts the form submission data blindly regarding role assignment. This constitutes a classic case of insecure direct object references combined with broken access control, where the application does not properly verify whether the user has met all necessary conditions before granting elevated permissions.
The operational impact of this vulnerability is severe due to the immediate elevation of privileges granted to newly created accounts. An attacker who successfully exploits this flaw gains administrative-level access to the WordPress installation almost instantly upon registration. This level of access provides full control over the website, including the ability to modify core files, install malicious plugins, alter database contents, and potentially compromise other users' data stored within the system. In enterprise environments or high-traffic sites, this could lead to complete site takeover, defacement, data exfiltration, or use as a pivot point for further attacks against internal networks if the server is part of a larger infrastructure. The ease of exploitation means that automated scanning tools can rapidly identify and exploit these instances across the internet.
This vulnerability aligns with CWE-284, which describes Improper Access Control, specifically where access control decisions are not properly enforced or verified before granting privileges. It also maps to MITRE ATT&CK technique T1078, Valid Accounts, as it allows an attacker to obtain legitimate administrative credentials through a non-standard path that bypasses intended security controls. Furthermore, the mechanism relates to CWE-693, Protection Mechanism Failure, because the built-in protection designed to restrict role assignment based on payment status fails to operate correctly under specific configuration states.
Mitigation strategies must prioritize immediate patching and configuration review. Administrators should update WP User Manager to version 2.9.26 or later as soon as possible to resolve the underlying code defect that allows this bypass. In cases where updating is not immediately feasible, temporary mitigations include disabling any paid registration forms until the payment gateway connection is restored and verified. Additionally, administrators should audit user roles assigned through these forms and ensure that default registration settings do not grant high-privilege roles by default. Implementing additional server-side validation checks or using a Web Application Firewall to monitor for unusual registration patterns can provide supplementary protection against exploitation attempts while permanent fixes are deployed. Regular security audits of plugin configurations and payment integrations are essential to prevent similar logic flaws in future updates.