WP User Manager

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.26. The CNA vector indicates that no prior authentication is required. The export does not disclose the endpoint, input parameter, vulnerable function or detailed input-processing path. No additional exploit mechanics are inferred. The precise affected operation and resulting application-level impact are not described beyond the vulnerability class. The structured affected range is <= 2.9.26.

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it. Other endpoint, parameter, role or implementation details not named in this export are not established by this record. Affected versions: 2.9.21 to before 2.9.26.

A low-privilege authenticated attacker can reach functionality without the required authorization. The CNA vector indicates limited integrity through manipulation of user state impact. The export does not disclose the endpoint, action, parameter, function, protected resource or exact operation, nor the specific WordPress role. No more specific exploit mechanics are inferred. Affected versions: at most 2.9.25. The completed CNA record identifies 2.9.26 as fixed.

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment. The export supplies no additional endpoint, action, parameter or function details beyond those described above.

A request can reach a protected operation in WP User Manager without its intended authorization check. The CNA vector requires no authentication and no victim interaction, with limited unauthorized information disclosure. The export does not identify the endpoint, action, parameter, affected records or operation. A specific account-takeover, payment-manipulation or code-execution chain is not established. Affected versions: at most 2.9.24. The authoritative export identifies 2.9.25 as fixed for this CVE.

Requests can reach a protected operation without the required authorization check. The CNA vector requires low privileges and no victim interaction, and rates the impact as unauthorized changes to protected data. The narrative does not identify the specific records or operation. The export does not identify the affected endpoint, action, parameter, function or exact WordPress role. It does not establish account takeover or code execution. Affected versions: <= 2.9.22. The authoritative export identifies 2.9.23 as fixed for this CVE.

No attacker login is required by the supplied CVSS vector. A caller can reach a protected operation without the intended permission check. The vector reports limited confidentiality impact, limited integrity impact and no victim interaction. The protected operation, resource and resulting state change or exposed data are undisclosed. The privilege-abuse classification does not establish administrator account creation or a particular privilege-escalation path. The authoritative export does not identify the vulnerable endpoint, action, parameter or function, so the exact input-to-operation path cannot be established from this record. Affected versions: <= 2.9.20. The authoritative export identifies 2.9.21 as fixed for this CVE.

An unauthenticated attacker can invoke functionality across a missing or inadequate authorization boundary. The affected endpoint, action, parameter and exact protected operation are unspecified; no particular credential leak, payment action or code-execution chain is inferred. Affected versions: n/a through 2.9.19. Confirmed fixed release: 2.9.20.

A Subscriber can complete an attacker-controlled Stripe Connect OAuth flow and invoke the target’s callback. Connect::complete(), registered on admin_init, performs neither a capability nor nonce check before retrieving credentials from the WPUM connect service and writing publishable/secret keys, gateway mode and connected account ID into wpum_settings via wpum_update_option()/update_option(). Subsequent Stripe payments can be routed to the attacker’s account. Reaching admin_init is not proof of administrative permission. Affected versions: <= 2.9.18. Confirmed fixed release: 2.9.19.

WP User Manager is affected by arbitrary file deletion. Exploitation requires an authenticated subscriber account. A successful request can remove files outside the intended scope and may make the site unavailable. The published affected range is n/a through 2.9.16.

WP User Manager – User Profile Builder & Membership is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is <= 2.9.17.

WP User Manager is affected by code execution. Exploitation requires an authenticated subscriber account. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

WP User Manager is affected by code execution. Exposure depends on how the affected operation is made reachable by the site. Successful exploitation can run attacker-controlled code in the WordPress hosting account.

WP User Manager – User Profile Builder & Membership is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP User Manager – User Profile Builder & Membership is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.

WP User Manager is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.

WP User Manager is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.