CVE-2026-110527 in WP User Manager Plugin
Summary
by MITRE • 10/17/2026
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified in versions of the WP User Manager plugin prior to version 2.9.20 represents a critical flaw in the user registration workflow that bypasses intended access controls through improper transactional state management. This issue specifically affects implementations where account creation is gated behind a payment gateway, such as PayPal or Stripe, which are commonly used for membership sites and paid content platforms. The core technical failure lies in the plugin's handling of asynchronous payment processes. When a user initiates registration by providing their details and being redirected to a third-party payment processor, the system creates a preliminary WordPress account with a pending status. However, if the subsequent payment step fails due to insufficient funds, declined cards, or network timeouts, the application logic does not trigger a rollback mechanism to delete or deactivate this newly created user entity. Consequently, the account remains active in the database despite the lack of financial compensation from the end-user.
From an operational perspective, this flaw allows unauthenticated attackers to register functional accounts on the target WordPress site without completing any payment obligations. This constitutes a direct violation of business logic integrity and access control policies designed by the website administrator. The impact extends beyond simple revenue loss; it introduces significant security risks related to resource exhaustion through mass account creation attacks, potential abuse of user-specific features such as commenting or profile editing, and increased attack surface for further exploitation if those accounts are granted elevated privileges. Furthermore, this behavior can lead to database bloat and performance degradation over time as thousands of inactive but active-looking accounts accumulate on the server.
In terms of industry standard classifications, this vulnerability aligns with CWE-840, which describes a condition where an error occurs during transaction processing that results in inconsistent state or data loss, specifically here manifesting as unauthorized account creation due to failed rollback logic. It also relates closely to CWE-269, indicating improper privilege management, although the primary issue is more accurately categorized under business logic flaws rather than traditional permission escalation. Within the MITRE ATT&CK framework, this behavior facilitates Initial Access by allowing adversaries or malicious actors to establish a foothold on the system without authentication credentials that would normally require payment verification. This falls under techniques associated with Account Manipulation and potentially Resource Hijacking if used for distributed denial-of-service preparation via automated registration scripts.
To mitigate this vulnerability, administrators must upgrade the WP User Manager plugin to version 2.9.20 or later, where the developers have implemented proper transactional integrity checks that ensure accounts are either fully activated upon successful payment or deleted immediately upon failure. For organizations unable to patch immediately due to compatibility constraints with other plugins, a temporary mitigation involves implementing server-side monitoring scripts that periodically scan for user accounts created within a short timeframe without corresponding payment records in external gateway logs and automatically deleting them. Additionally, enabling CAPTCHA on registration forms can help mitigate automated abuse of this flaw by increasing the cost of mass account creation attacks. Regular auditing of user databases to identify orphaned or suspiciously active unverified accounts is also recommended as part of ongoing security hygiene practices for WordPress environments handling sensitive data or paid services.