Patch WP User Manager to Block Unauthenticated Admin Access via CVE-2026-110523

A vulnerability in the WP User Manager WordPress plugin allows unauthenticated users to escalate their privileges to an administrator-equivalent role. This bypass occurs when a paid registration form remains published after its associated payment gateway has been disconnected. The flaw, identified as CVE-2026-110523, fails to enforce the intended capability restrictions that should block role assignment without successful payment.

The risk

The National Vulnerability Database assigns a CVSS score of 8.1, classifying CVE-2026-110523 as a high-severity issue. The core weakness lies in the plugin's inability to maintain security controls when the financial transaction mechanism fails or is removed. An attacker does not need to log in or possess any prior credentials to exploit this flaw.

Who is exposed

Any WordPress installation running WP User Manager versions prior to 2.9.26 is susceptible to this attack. The risk is highest for sites that utilize paid registration forms but have experienced a disconnection of their payment gateway. If a published form continues to assign configured roles after the gateway disconnects, the environment is open to unauthorized privilege escalation.

Cost and compliance

The source material does not provide specific data regarding financial costs, regulatory penalties or compliance impacts associated with CVE-2026-110523. Organizations must assess their own internal policies regarding unauthorized administrative access and data integrity to determine the potential business impact of this high-severity flaw.

Our take on the response

The vendor has released version 2.9.26 to address this specific bypass. Security teams should immediately verify their plugin versions and apply the update to restore the intended payment gating logic. Delaying the update leaves the door open for unauthenticated attackers to seize full control of the site backend.

What defenders should look for

Teams usually monitor for spikes in new user registrations that lack corresponding payment records. Check whether unauthenticated requests are successfully assigning high-privilege roles to newly created accounts. Look for anomalous administrative actions originating from users who did not complete the required financial transaction. Contain the issue by disabling the affected registration forms and restricting access to the administration panel until the plugin is updated.

What to do and how to stay safe: WP User Manager

• Audit all WordPress installations to identify instances of WP User Manager running versions older than 2.9.26.
• Review the status of payment gateways connected to registered forms to ensure they are active and properly linked.
• Implement monitoring for sudden increases in administrator-level account creations that do not match payment logs.
• Apply the vendor-provided update once available to restore the security controls that prevent unauthorized role assignment.

Step-by-step guide: Unpatched Software Response: Containment, Recovery, and Prevention Steps

General security guidance from the BlueTeam Herald newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the CVSS score for CVE-2026-110523?

The National Vulnerability Database rates the vulnerability as high severity with a CVSS score of 8.1.

Which versions of WP User Manager are affected?

All versions of the WP User Manager WordPress plugin before 2.9.26 are affected by this flaw.

How does the vulnerability allow unauthorized access?

Unauthenticated users can register and obtain a privileged administrator-equivalent role if the payment gateway is disconnected while the paid registration form remains published.