CVE-2026-18345: WP User Manager Auth Bypass Vulnerability

CVE-2026-18345 Overview

CVE-2026-18345 affects the WP User Manager plugin for WordPress in versions up to and including 2.9.18. The plugin exposes the Connect::complete() function on the admin_init hook without a capability check or nonce verification. Any authenticated user reaching /wp-admin/, including Subscribers, can invoke the callback and overwrite the site's Stripe credentials stored in the wpum_settings option. Attackers redirect all future Stripe payments to their own connected Stripe account, resulting in direct financial loss for the site operator.

Critical Impact
Subscriber-level users can hijack the site's Stripe integration and reroute customer payments to an attacker-controlled Stripe account.

Affected Products

WP User Manager plugin for WordPress, versions up to and including 2.9.18
WordPress sites using the WPUM Stripe integration
Any WPUM deployment allowing Subscriber-level or higher registrations

Discovery Timeline

2026-09-22 - CVE-2026-18345 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-18345

Vulnerability Analysis

The flaw is a missing authorization issue [CWE-862] in the Stripe integration of WP User Manager. The Connect::complete() method registers as a callback on the WordPress admin_init action. This hook fires for every authenticated request into wp-admin/, including users holding the default Subscriber role.

The function performs no current_user_can() privilege check and no wp_verify_nonce() request validation before executing sensitive logic. It fetches Stripe credentials from the external WPUM connect service and writes the publishable key, secret key, gateway mode, and connected Stripe account ID into the wpum_settings option using wpum_update_option() and update_option().

Because the callback trusts any authenticated visitor to wp-admin/, an attacker with a low-privileged account can substitute their own Stripe account for the site's, silently altering the payment destination for all subsequent transactions.

Root Cause

The root cause is broken access control on a state-changing administrative callback. WordPress hooks fired on admin_init require developers to enforce capability and nonce checks explicitly. The affected Connect.php code path (see lines 21, 177, and 203 in the 2.9.18 tag) skips both controls and unconditionally persists attacker-supplied gateway configuration.

Attack Vector

Exploitation requires the attacker to hold Subscriber-level credentials or higher, which is trivially obtainable on sites that allow open user registration. The attacker first completes their own Stripe Connect OAuth flow against the WPUM connect service. They then log into the target site and issue a request to /wp-admin/ carrying the OAuth callback parameters. The Connect::complete() handler validates nothing, retrieves the attacker's Stripe credentials from the external service, and overwrites the site's stored gateway configuration. Subsequent customer payments settle into the attacker's Stripe account.

Refer to the Wordfence Vulnerability Report and the affected source in Connect.php Line 177 for technical details.

Detection Methods for CVE-2026-18345

Indicators of Compromise

Unexpected changes to the wpum_settings WordPress option, particularly to Stripe publishable_key, secret_key, gateway_mode, or connected account_id values.
Authenticated /wp-admin/ requests from Subscriber-role accounts containing Stripe Connect OAuth callback parameters (for example code, state, scope).
Payments recorded in the site's order log that do not appear in the merchant's Stripe dashboard.

Detection Strategies

Compare the current values of Stripe keys in wpum_settings against a known-good baseline captured before the plugin was deployed or last configured.
Review WordPress audit logs for update_option events referencing wpum_settings initiated by non-administrator users.
Inspect webserver access logs for hits to wp-admin/ immediately followed by Stripe API traffic to unfamiliar acct_ identifiers.

Monitoring Recommendations

Alert on any modification to wpum_settings performed by accounts below the Administrator role.
Continuously monitor Stripe dashboard for changes to the connected account and reconcile payment settlement identifiers daily.
Track new Subscriber registrations followed by immediate wp-admin/ activity as a behavioral anomaly.

How to Mitigate CVE-2026-18345

Immediate Actions Required

Update the WP User Manager plugin to a version released after 2.9.18 that includes the fix referenced in the WordPress Changeset Update.
Rotate Stripe API keys and re-authorize the Stripe Connect integration from the site's Administrator account.
Audit the wpum_settings option and confirm the connected Stripe account_id matches the merchant's legitimate account.

Patch Information

The vendor patched the vulnerability in the WP User Manager repository. The remediation adds capability and request-origin checks to the Connect::complete() handler so that only authorized administrators can invoke the Stripe callback. Review the fix in the WordPress Changeset Update and the pre-patch source at Connect.php Line 21.

Workarounds

Disable the WP User Manager Stripe integration until the plugin is upgraded to a patched release.
Restrict /wp-admin/ access to trusted IP ranges via webserver rules or a web application firewall.
Disable open user registration or restrict the default new-user role to prevent low-privileged accounts from reaching admin_init.

bash

# Restrict wp-admin access with an .htaccess allow-list as a temporary control
<Files wp-login.php>
  Require ip 203.0.113.0/24
</Files>
<Directory "/var/www/html/wp-admin">
  Require ip 203.0.113.0/24
</Directory>