The WP User Manager WordPress plugin, versions 2.9.21 through 2.9.25, contains a flaw that allows an unauthenticated visitor to register through a paid registration form after the Stripe payment gateway has been disconnected. This vulnerability is an instance of CWE-269, as it allows the plugin to bypass role assignment restrictions after the payment gateway is disconnected. Because the plugin no longer enforces the configured role restriction, the new account is immediately granted the privileged role set for paid registrations, which is effectively equivalent to an administrator. This direct assignment of elevated privileges without completing the intended payment allows an attacker to gain full control of the WordPress site.

Affected systems include the WP User Manager plugin distributed for WordPress. The vulnerability exists in plugin releases 2.9.21, 2.9.22, 2.9.23, 2.9.24, and 2.9.25. Users running these versions with a published paid registration form that relies on Stripe for payment are at risk. Upgrading to version 2.9.26 or later removes the flaw.

The EPSS score of less than 1% indicates a low probability of widespread exploitation, but the vulnerability remains high impact because an unauthenticated visitor can complete the paid registration form and be granted an administrator-equivalent role. With a publicly exposed registration endpoint, exploitation requires only a network submission of the form, making the attack vector network‑based and trivially achievable. The CVSS score of 8.1 highlights a severe risk, and the flaw is not listed in CISA’s Known Exploited Vulnerabilities catalog, underscoring the need for immediate remediation.