WP User Manager CVE-2026-110523

Exploitation requires a specific non-default operational state in WP User Manager (versions 2.9.21-2.9.25): a paid registration form must be published and configured to assign a privileged, administrator-equivalent role, AND the configured payment gateway must be disconnected/inactive while that form remains live. The capability restriction that normally gates the role behind completed payment is not kept in force once the gateway is disconnected. Limiting factors: the site must previously have deployed paid registration granting a high-privilege role and then disconnected the gateway without unpublishing the form - a site that never used paid registration, never assigned a privileged role via the form, or unpublished the form is not exploitable. No user interaction or authentication is required of the attacker (unauthenticated, per PR:N/UI:N).

This is a genuinely high-impact privilege-escalation flaw (CWE-269) but its real-world urgency is tempered by a specific preconditioning requirement reflected in the CVSS vector. The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/C:H/I:H/A:H, base 8.1) is internally consistent with the description: AV:N and PR:N are correct because any unauthenticated visitor can submit a public registration form, while AC:H correctly captures that exploitation only works when the site is in a non-default state - a paid registration form configured to grant an administrator-equivalent role is still published AFTER the payment gateway has been disconnected. A publicly available exploit code exists (published by WPScan), which raises practical risk, but there is NO CISA KEV listing and NO EPSS score was provided in the input, so there is no evidence of active or widespread exploitation at time of analysis. Net: the C:H/I:H/A:H impact (full admin-equivalent takeover) makes this a real priority for any site that actually ran paid registration and then disconnected its gateway, but the AC:H conditional configuration dependency means it is not a blanket mass-exploitation threat against all installs. Do not conflate the public POC with active exploitation - they are distinct signals, and no in-the-wild activity is confirmed here.

A WordPress site previously used WP User Manager's paid registration to gate an administrator-equivalent role behind payment, then disconnected or deactivated its payment gateway while leaving the paid registration form published. An unauthenticated attacker simply submits that still-live registration form and is immediately granted the privileged role without any payment, gaining admin-equivalent control. A public exploit for this condition has been published by WPScan.