Wp User Manager User Profile Builder Membership
Monthly
Authenticated Stripe integration hijacking in WP User Manager (User Profile Builder & Membership) versions up to and including 2.9.18 lets any logged-in user at Subscriber level or above overwrite the site's stored Stripe credentials, causing future payments to be routed to an attacker-controlled Stripe account. The flaw is a missing authorization check (CWE-862): Connect::complete() runs on admin_init without any current_user_can() or nonce verification, so merely reaching a /wp-admin/ page is enough to trigger it. Exploitation requires a low-privilege account on the target site plus a completed attacker-side Stripe Connect OAuth flow, and it only has impact where WPUM's Stripe Connect integration is actively in use; CVSS 3.1 base is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting integrity-only impact, and no public exploit code was identified at time of analysis.
Authenticated Stripe integration hijacking in WP User Manager (User Profile Builder & Membership) versions up to and including 2.9.18 lets any logged-in user at Subscriber level or above overwrite the site's stored Stripe credentials, causing future payments to be routed to an attacker-controlled Stripe account. The flaw is a missing authorization check (CWE-862): Connect::complete() runs on admin_init without any current_user_can() or nonce verification, so merely reaching a /wp-admin/ page is enough to trigger it. Exploitation requires a low-privilege account on the target site plus a completed attacker-side Stripe Connect OAuth flow, and it only has impact where WPUM's Stripe Connect integration is actively in use; CVSS 3.1 base is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), reflecting integrity-only impact, and no public exploit code was identified at time of analysis.