CVE-2026-110527: WP User Manager Auth Bypass Vulnerability

CVE-2026-110527 Overview

CVE-2026-110527 affects the WP User Manager WordPress plugin in versions before 2.9.20. The plugin fails to roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails. This behavior allows unauthenticated users to create functional accounts without completing payment. The flaw is categorized under improper access control [CWE-284] and carries an integrity impact on affected sites. Site operators who rely on payment gating to control membership access cannot trust the registration workflow to enforce payment before provisioning user accounts.

Critical Impact
Unauthenticated attackers can obtain functional WordPress user accounts on sites running WP User Manager without paying for membership, bypassing the plugin's payment gate.

Affected Products

WP User Manager WordPress plugin versions prior to 2.9.20
WordPress sites using WP User Manager payment-gated registration
Membership workflows dependent on WP User Manager payment enforcement

Discovery Timeline

2026-10-17 - CVE-2026-110527 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-110527

Vulnerability Analysis

The WP User Manager plugin supports a registration flow where a visitor must complete a payment step before gaining full membership. The registration logic creates the WordPress user account before confirming payment success. When the payment step fails, errors out, or is abandoned, the plugin does not delete or disable the account it already created. The orphaned account remains in the WordPress users table as a functional login identity. An unauthenticated attacker only needs to initiate the registration flow and intentionally fail the payment step to leave behind a usable account.

Root Cause

The root cause is a missing compensating transaction in the registration workflow. The plugin treats account provisioning and payment capture as independent steps rather than as a single atomic operation. There is no rollback handler that removes the WordPress account when the payment call returns a failure status. This design pattern maps to improper access control [CWE-284] because the account persists outside the intended authorization boundary enforced by payment.

Attack Vector

An attacker reaches the public registration page over the network without authentication. They submit valid registration details and proceed to the payment step. They then cancel, fail, or decline the payment transaction. The plugin leaves the account intact, and the attacker logs in with the credentials they chose during registration. The attacker gains the role assigned to new registrants, which may include access to member-only content, forum participation, or profile features gated behind paid membership.

No verified public exploit code is available. See the WPScan Vulnerability Report for additional technical context.

Detection Methods for CVE-2026-110527

Indicators of Compromise

New WordPress user accounts in wp_users without matching successful payment records in the plugin's transaction log
Repeated registration attempts from the same IP address followed by failed or canceled payment events
Logins from accounts whose membership status in WP User Manager shows no active paid subscription

Detection Strategies

Reconcile WordPress user creation timestamps against the plugin's payment gateway success events and flag mismatches
Audit the wp_usermeta table for members with registration dates but no wpum_payment_status set to a paid state
Monitor web server logs for POST requests to registration endpoints followed by payment cancellation callbacks from the same session

Monitoring Recommendations

Enable WordPress audit logging for user_register events and correlate with payment gateway webhook logs
Alert on user accounts created during sessions where the payment processor returned a non-success response
Review new account creation rates on a daily basis and investigate volume anomalies on membership-gated sites

How to Mitigate CVE-2026-110527

Immediate Actions Required

Update WP User Manager to version 2.9.20 or later on all WordPress installations
Audit all user accounts created before the patch and verify each has a corresponding completed payment
Delete or suspend WordPress accounts that cannot be matched to a successful payment transaction

Patch Information

The vendor addressed the issue in WP User Manager version 2.9.20. Site administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin files with the patched release. Verify the installed version in the plugins list after update. Consult the WPScan Vulnerability Report for the vendor fix reference.

Workarounds

Disable payment-gated registration until the plugin is updated to version 2.9.20
Restrict access to the registration page using an IP allowlist or temporary maintenance mode during patch rollout
Require administrator approval for all new registrations by enabling manual user approval in WP User Manager settings

bash

# Verify plugin version via WP-CLI
wp plugin get wp-user-manager --field=version

# Update WP User Manager to the patched release
wp plugin update wp-user-manager --version=2.9.20

# List users created without a paid membership status for review
wp user list --meta_key=wpum_payment_status --meta_value='' --format=table