WP User Manager EUVD-2026-103257

Exploitation requires that the target site runs WP User Manager (version 2.9.x below 2.9.20) with its payment-gated registration workflow enabled - i.e., registration is configured to require a completed payment. The attack is triggered by initiating that registration flow and then letting the payment step fail or abandoning it; the plugin creates the WordPress account before payment confirmation and never rolls it back. The principal limiting factor is configuration-dependence: sites that do not use payment-gated/paid registration are unaffected, which meaningfully narrows the exposed population below the raw AV:N/PR:N vector. No authentication and no user interaction beyond the attacker's own registration attempt are needed against a vulnerable, in-scope configuration.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, base 5.3 Medium) is internally consistent and credible: this is a remote, unauthenticated, low-complexity flaw with no user interaction, but with impact limited to Integrity-Low (unauthorized account creation) and zero Confidentiality or Availability impact. No EPSS score, SSVC decision, or CISA KEV entry was supplied in the input, and no public exploit code is referenced, so there is no signal of active or probable exploitation to contrast against the CVSS. The signals are therefore concordant rather than conflicting - a genuinely low-to-moderate priority. This is best characterized as a business-logic/authorization abuse (bypassing a payment gate) rather than a system-compromise vulnerability: the created account is a standard, functional WordPress user, not necessarily an administrator, so the practical damage is revenue loss and unpaid access, not takeover. One caveat to verify with the vendor: the privilege level of the auto-created account is not stated, and if the payment-gated role grants elevated capabilities the real-world Integrity impact could be higher than the base vector suggests. Missing EPSS/KEV/POC data is an absence of signal, not evidence of safety.

An attacker visits a WordPress site running WP User Manager with payment-gated registration enabled, submits the registration form to trigger account creation, and then allows the subsequent payment step to fail or abandons it. Because the plugin does not roll back the already-created WordPress account, the attacker is left with a working, logged-in account without ever paying. No public exploit code is referenced in the available data, but the technique requires only ordinary browser interaction with the registration flow.