CVE-2026-110523 WP User Manager CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP User Manager plugin, particularly those using paid registration roles, should assess exposure and verify the version of the plugin in use.

Why it matters

CVE-2026-110523 is a vulnerability in the WP User Manager WordPress plugin that allows unauthenticated users to escalate privileges to an administrator-equivalent role. Defenders should prioritize verifying the version of the plugin in use and ensuring that it is updated to a version that fixes this vulnerability.

• Defenders need to verify the version of WP User Manager in use and update to a fixed version to prevent unauthorized privilege escalation.
• Systems using the WP User Manager plugin with paid registration roles may be vulnerable to exploitation, allowing attackers to gain administrator-equivalent privileges.
• Defenders should review system logs to detect any potential exploitation of this vulnerability.
• Remediation priority is high for systems using affected versions of the WP User Manager plugin.

Technical summary

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it. This vulnerability affects WordPress installations using the WP User Manager plugin with paid registration roles. Defenders should verify the version of the plugin in use and ensure that it is updated to a version that fixes this vulnerability. The vulnerability allows unauthenticated users to escalate privileges to an administrator-equivalent role after the Stripe payment gateway is disconnected.

Defensive priority

Defenders should prioritize verifying the version of WP User Manager in use and ensuring that it is updated to a version that fixes this vulnerability. Additionally, defenders should review their systems for any unauthorized privilege escalations.

Recommended defensive actions

• Verify the version of WP User Manager in use and update to a fixed version if necessary
• Review system logs for any unauthorized privilege escalations
• Monitor for any suspicious activity related to the WP User Manager plugin
• Perform a thorough review of system configurations and user roles to identify potential vulnerabilities
• Implement additional monitoring and logging to detect potential exploitation attempts
• Conduct a thorough asset inventory to identify all systems using the WP User Manager plugin
• Review and update incident response plans to include procedures for responding to potential exploitation of this vulnerability

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description and affected versions. However, there is limited information about the impact of the vulnerability and the number of affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.