WordPress Vulnerability Scanner WPSec
Vulnerabilities / WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory

WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerabilities

Advisories WPSec published for WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory. Other sources may list more. Its attack surface: WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-21 WPSEC-2026-1402 WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Authenticated (Subscriber+) Paid Access Bypass via Stripe Customer Portal Plan Change Medium 4.2 2.10.0
2026-10-15 WPSEC-2026-1006 WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.24 - Unauthenticated Site Access Restriction Bypass via Password Reset Page URL Prefix Low 3.7 2.9.25
2026-10-15 WPSEC-2026-1005 WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.24 - Unauthenticated Site Access Restriction Bypass via REST API Prefix in Request URI Medium 5.3 2.9.25
2026-10-10 WPSEC-2026-0703 WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.22 - Authenticated (Subscriber+) Payment Bypass via Stripe Checkout Plan Selection Medium 4.3 2.9.23
2026-10-03 WPSEC-2026-0396 WP User Manager – User Profile Builder & Membership <= 2.9.21 - Unauthenticated Sensitive Information Exposure via REST API Medium 5.3 2.9.22
2026-10-01 WPSEC-2026-0055 WP User Manager – User Profile Builder & Membership <= 2.9.20 - Unauthenticated Stripe Payment Bypass to Paid Role Capabilities and Role-Restricted Content Medium 4.8 2.9.21

License: CC BY 4.0