CVE-2026-110523

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.26

Description The plugin fails to maintain paid-registration capability restrictions when the payment gateway is disconnected. If a paid registration form remains published, it continues to assign the configured role to users. This allows unauthenticated users to register and obtain a privileged administrator-equivalent role without completing the required payment.

Recommendations Update to version 2.9.26 or later.