CVE-2026-110527 WP User Manager CVE debrief

Who should care

Defenders responsible for WordPress installations using the WP User Manager plugin should assess exposure and prioritize verification of the plugin version and monitoring for suspicious account creation activity.

Why it matters

CVE-2026-110527 is a vulnerability in the WP User Manager WordPress plugin that allows unauthenticated users to create functional accounts without completing payment. Defenders should prioritize verifying the plugin version and monitoring for suspicious account creation activity.

• Defenders should verify the version of the WP User Manager plugin to prevent unauthorized account creation.
• Defenders should monitor for suspicious account creation activity to detect potential exploitation.
• Defenders should review payment-gated registration processes to identify potential vulnerabilities.

Technical summary

The WP User Manager WordPress plugin before version 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment. This issue arises from inadequate handling of payment-gated registration processes. Defenders should prioritize verifying the plugin version and monitoring for suspicious account creation activity to detect potential exploitation. Affected product deployments should be identified and verified for exposure.

Defensive priority

Defenders should prioritize verifying the version of the WP User Manager plugin and ensuring that it is updated to 2.9.20 or later. Additionally, defenders should monitor for any suspicious account creation activity.

Recommended defensive actions

• Verify the version of the WP User Manager plugin and ensure it is updated to 2.9.20 or later.
• Monitor for suspicious account creation activity.
• Review payment-gated registration processes for potential vulnerabilities.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. The WPScan reference provides additional details about the vulnerability. However, the scope of affected deployments and potential exposure are not explicitly stated. Defenders should verify the plugin version and review payment-gated registration processes to identify potential vulnerabilities. Evidence is limited to public sources and may not reflect the full scope of the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.