A in WP User Manager before version 2.9.20 allows the plugin to leave a user account in WordPress when the payment step of a gated registration fails. Because the account is never rolled back, an unauthenticated visitor can create a fully functional user account without paying a required fee. The vulnerability is an authorization failure that permits an attacker to create accounts that may be used for spam, credential stuffing, or gaining access to restricted content. This flaw is a direct result of insufficient handling of erroneous payment processing and bypasses the intended registration workflow.

The vulnerability affects the WordPress plugin WP User Manager versions 2.9.0 through 2.9.19. Administrators using any of these release versions that have enabled payment‑gated registration are at risk. The issue is limited to the plugin itself and does not involve the core WordPress authentication system.

The vulnerability has a CVSS score of 5.3 and an EPSS score of <1%, indicating a moderate severity and low probability of exploitation. It is exploitable by any unauthenticated user on sites running the affected plugin. The flaw is not listed in the CISA KEV catalog. Because an attacker can simply visit the registration page and complete the process with a fake payment, the likelihood of exploitation is moderate. Once an unauthorized account is created, the attacker could use it to access any content or resources that rely on standard WordPress role permissions, thus impacting confidentiality, integrity, and availability of the site.