CVE-2026-110523CWE-269privilege-escalation

CVE-2026-110523

High · published October 21, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
21.5
In the wild
Unconfirmed
What it is

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00299 · 21.5th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2026-10-21T10:16Z
References (1)
https://wpscan.com/vulnerability/0f26a111-043f-4f03-899a-256673672fd3/ · [email protected]
EPSS history
Timeline
  • 22 OCT 03:28Z
    EPSS moved — → 0%
    epss
  • 21 OCT 06:00Z
    WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect
    cvelistv5
  • 21 OCT 06:00Z
    WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect
    cvelistv5