WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Authenticated (Subscriber+) Paid Access Bypass via Stripe Customer Portal Plan Change
- ID
- WPSEC-2026-1402
- Plugin
- WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory (wp-user-manager)
- Affected
- from 2.9 before 2.10.0
- Remediation
- Update to 2.10.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N
- Weakness
- CWE-840
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-21
- Attack surface
- WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory on WPSec AttackSurface
- Fix released
- Published
Description
The WP User Manager plugin for WordPress is vulnerable to a paid access bypass via the Stripe integration in versions 2.9 up to, and including, 2.9.26. This is due to User::isSubscribed() treating any active Stripe subscription as paid, and User::getAllowedPlanIds() counting the subscription's current price as one of the member's allowed plans, without checking that price against the plan the member registered for. This makes it possible for authenticated attackers with an active subscription and Subscriber-level access or above to switch their subscription to a cheaper price, including one offered on another registration form, through the Stripe customer portal and keep the role and access of the plan they registered for. Exploitation requires plan switching to be enabled in the site's Stripe customer portal configuration.
References
- https://wpsec.com/vuln/WPSEC-2026-1402/
- https://plugins.svn.wordpress.org/wp-user-manager/tags/2.10.0/
- https://wordpress.org/plugins/wp-user-manager/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS