{
 "id": "WPSEC-2026-1402",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1402/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1402/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1402/index.md",
 "title": "WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Authenticated (Subscriber+) Paid Access Bypass via Stripe Customer Portal Plan Change",
 "description": "The WP User Manager plugin for WordPress is vulnerable to a paid access bypass via the Stripe integration in versions 2.9 up to, and including, 2.9.26. This is due to User::isSubscribed() treating any active Stripe subscription as paid, and User::getAllowedPlanIds() counting the subscription's current price as one of the member's allowed plans, without checking that price against the plan the member registered for. This makes it possible for authenticated attackers with an active subscription and Subscriber-level access or above to switch their subscription to a cheaper price, including one offered on another registration form, through the Stripe customer portal and keep the role and access of the plan they registered for. Exploitation requires plan switching to be enabled in the site's Stripe customer portal configuration.",
 "plugin": {
  "slug": "wp-user-manager",
  "name": "WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory",
  "full_name": "WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory",
  "wordpress_org": "https://wordpress.org/plugins/wp-user-manager/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-user-manager/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-user-manager"
 },
 "type": "BYPASS",
 "cwe": [
  "CWE-840"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.2,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "2.9",
    "from_inclusive": true,
    "to": "2.10.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 2.9 before 2.10.0"
  ]
 },
 "introduced_in": "2.9",
 "fixed_in": "2.10.0",
 "remediation": "Update to 2.10.0 or later.",
 "fix_released": "2026-10-20T19:49:02+00:00",
 "published": "2026-10-21T20:43:15+00:00",
 "updated": "2026-10-21T10:34:28.908872+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1402/",
  "https://plugins.svn.wordpress.org/wp-user-manager/tags/2.10.0/",
  "https://wordpress.org/plugins/wp-user-manager/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-user-manager",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-21"
 }
}