The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
| Vendor | Product | Versions |
|---|---|---|
| WordPress | WP User Manager Plugin | 2.9.21 |
Loading…
Added vendor/product details, confirmed affected version 2.9.25, identified CWE-269 for improper privilege management, and set severity to MEDIUM based on vulnerability classification.
Initial creation
