WP User Manager: Payment-gated registration bypass
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment. The export supplies no additional endpoint, action, parameter or function details beyond those described above.
- Component
- WP User Manager
- Plugin slug
wp-user-manager- Affected
- 2.9 to < 2.9.20
- Safe version
2.9.20- Published
- Oct 17, 2026
This CVE was published Oct 17, 2026 and is one of 17 known issues for this plugin.
Update, patch or deactivate.
Update WP User Manager to 2.9.20 or a later supported release in the applicable branch. The completed authoritative export identifies this fixed release. Do not activate a usable account until required payment succeeds; clean up or disable registrations when payment fails.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N