WP User Manager – User Profile Builder & Membership <= 2.9.20 - Unauthenticated Stripe Payment Bypass to Paid Role Capabilities and Role-Restricted Content
- ID
- WPSEC-2026-0055
- Plugin
- WP User Manager – User Profile Builder & Membership (wp-user-manager)
- Affected
- from 2.9 before 2.9.21
- Remediation
- Update to 2.9.21 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-863
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- WP User Manager – User Profile Builder & Membership on WPSec AttackSurface
- Fix released
- Published
Description
The WP User Manager – User Profile Builder & Membership plugin for WordPress is vulnerable to a payment bypass in its Stripe paid registration feature in versions 2.9 up to, and including, 2.9.20. This is due to the registration form assigning its configured role as soon as the account is created, before the Stripe checkout is completed, while the only payment enforcement was a front-end redirect to the billing page (template_redirect) that did not apply to wp-admin, the REST API or admin-ajax, and role-restricted content checks (the wpum_restrict_to_user_roles shortcode, Elementor widget visibility and profile field visibility) looked only at the user's raw roles. This makes it possible for unauthenticated attackers to register through a paid registration form, abandon the checkout, and use the paid role's capabilities and read content restricted to that role without paying. Members whose Stripe subscription has lapsed keep the same access. Exploitation requires Stripe paid registration to be configured, and the impact depends on the capabilities of the role the site sells.
References
- https://wpsec.com/vuln/WPSEC-2026-0055/
- https://plugins.svn.wordpress.org/wp-user-manager/tags/2.9.21/
- https://wordpress.org/plugins/wp-user-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS