PT-2026-116370

CVE-2026-110527

Published

2026-10-17

Updated

2026-10-18

Description by

CVSS 3.1

5.3

Medium

MetricsAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.20

Description An issue exists during payment-gated registration where the software fails to roll back the creation of a WordPress account if the subsequent payment step fails. This allows unauthenticated users to create functional accounts without completing the required payment.

Recommendations Update WP User Manager to version 2.9.20 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Sanjorn Keeratirungsan

Vendors

Affected products

Weakness enumeration

CWE-284: Improper Access Control

Related identifiers