CVE-2026-110527 — WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails,…
Published: 2026-10-17 · CVSS: 5.3 · CVSS 3.1
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7