# WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.9.26 - Authenticated (Subscriber+) Paid Access Bypass via Stripe Customer Portal Plan Change

- **ID:** WPSEC-2026-1402
- **Plugin:** WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory (`wp-user-manager`), https://wordpress.org/plugins/wp-user-manager/
- **Affected versions:** from 2.9 before 2.10.0
- **Fixed in:** 2.10.0 (Update to 2.10.0 or later.)
- **Severity:** Medium 4.2 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-840
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-user-manager
- **Fix released:** 2026-10-20
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1402/

## Description

The WP User Manager plugin for WordPress is vulnerable to a paid access bypass via the Stripe integration in versions 2.9 up to, and including, 2.9.26. This is due to User::isSubscribed() treating any active Stripe subscription as paid, and User::getAllowedPlanIds() counting the subscription's current price as one of the member's allowed plans, without checking that price against the plan the member registered for. This makes it possible for authenticated attackers with an active subscription and Subscriber-level access or above to switch their subscription to a cheaper price, including one offered on another registration form, through the Stripe customer portal and keep the role and access of the plan they registered for. Exploitation requires plan switching to be enabled in the site's Stripe customer portal configuration.

## References

- https://wpsec.com/vuln/WPSEC-2026-1402/
- https://plugins.svn.wordpress.org/wp-user-manager/tags/2.10.0/
- https://wordpress.org/plugins/wp-user-manager/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1402/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.