CVE-2026-110523 The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gat
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-110523?
CVE-2026-110523 is a high-severity vulnerability in Unknown WP User Manager, published on 21 Oct 2026.
Official description
The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.
Weakness: CWE-269
Which versions are affected by CVE-2026-110523?
How do I fix CVE-2026-110523?
No fix has been published for CVE-2026-110523 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-110523 being exploited?
There is no known exploitation of CVE-2026-110523 in the wild and no public exploit code.
Sources
Also known as GHSA-5mcj-pr4f-hvfp.