These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-110523 is a vulnerability in the WP User Manager WordPress plugin versions 2.9.21 through 2.9.25. The vulnerability allows unauthenticated users to escalate privileges to an administrator-equivalent role after the Stripe payment gateway is disconnected, even if the user has not completed the payment for the role. This occurs because the plugin does not maintain its paid-registration capability re [truncated]
The CVE-2026-112823 vulnerability affects the WordPress WP User Manager plugin, versions up to 2.9.25. This issue is a Missing Authorization vulnerability, which allows for Manipulating User State. The CVSS score is 4.3, indicating a MEDIUM severity level. Defenders responsible for WordPress installations using the WP User Manager plugin should assess exposure and prioritize verification and potential upd [truncated]
CVE-2026-110527 is a vulnerability in the WP User Manager WordPress plugin before version 2.9.20. The plugin does not properly handle payment-gated registration, allowing unauthenticated users to create functional accounts without completing payment. This issue was made public on October 17, 2026. Affected deployments should be identified and verified for exposure. Defenders should review the plugin versi [truncated]
The CVE-2026-108496 vulnerability affects the WordPress WP User Manager plugin, specifically versions up to 2.9.23. This issue is related to a Missing Authorization vulnerability, which allows for Exploiting Incorrectly Configured Access Control Security Levels. The vulnerability has a CVSS score of 5.3 and a severity of MEDIUM. Defenders should verify the plugin version and review access control configur [truncated]
The CVE-2026-107423 vulnerability affects WordPress WP User Manager plugin versions up to 2.9.22, allowing Exploiting Incorrectly Configured Access Control Security Levels due to a Missing Authorization vulnerability. This issue has a CVSS score of 4.3 and is classified as MEDIUM severity. Affected deployments should be identified in managed environments, and owners should review official advisories to va [truncated]
CVE-2026-49766 is a critical vulnerability in the WP User Manager plugin for WordPress, affecting versions up to and including 2.9.16. This vulnerability allows a subscriber to delete arbitrary files on the server, potentially leading to significant impacts such as data loss, defacement, or even code execution if sensitive files are targeted.
