{"id":"CVE-2026-110523","title":"WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect","summary":"The WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configure…","severity":"none","cwe":["CWE-269"],"product":"WP User Manager","affected":["wp_user_manager >= 2.9.21 < 2.9.26"],"published":"2026-10-21","updated":"2026-10-21","sourceUpdated":"2026-10-21T06:00:21.719Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110523","references":[{"url":"https://wpscan.com/vulnerability/0f26a111-043f-4f03-899a-256673672fd3/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T06:42:48.179Z","slug":"CVE-2026-110523","body":"## Overview\n\nThe WP User Manager  WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.\n\n## Affected\n\n- `wp_user_manager >= 2.9.21 < 2.9.26`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}