WP User Manager lets Subscribers replace the Stripe payment destination
A Subscriber can complete an attacker-controlled Stripe Connect OAuth flow and invoke the target’s callback. Connect::complete(), registered on admin_init, performs neither a capability nor nonce check before retrieving credentials from the WPUM connect service and writing publishable/secret keys, gateway mode and connected account ID into wpum_settings via wpum_update_option()/update_option(). Subsequent Stripe payments can be routed to the attacker’s account. Reaching admin_init is not proof of administrative permission. Affected versions: <= 2.9.18. Confirmed fixed release: 2.9.19.
- Component
- WP User Manager – User Profile Builder & Membership
- Plugin slug
wp-user-manager- Affected
- <= 2.9.18
- Safe version
2.9.19- Published
- Sep 22, 2026
- Weakness
- CWE-862 — Missing Authorization
This CVE was published Sep 22, 2026 and is one of 17 known issues for this plugin.
Update, patch or deactivate.
Update to 2.9.19 or later. The official 2.9.19 notes add authorization to the Stripe Connect callback; 2.9.20 additionally binds it to the initiating administrator. Authorize the Stripe Connect callback and bind a one-time OAuth state to the administrator and site that initiated it. Confirm the returned connected account before saving credentials. Audit the configured Stripe account and payment destinations, restore authorized settings, and rotate affected credentials when warranted. Prefer 2.9.20 or later for the additional callback-to-initiating-administrator binding. Official changelog: https://wordpress.org/plugins/wp-user-manager/#developers
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N