A flaw in WP User Manager before version 2.9.20 allows the plugin to leave a user account in WordPress when the payment step of a gated registration fails. Because the account is never rolled back, an unauthenticated visitor can create a fully functional user account without paying a required fee. The vulnerability is an authorization failure that permits an attacker to create accounts that may be used for spam, credential stuffing, or gaining access to restricted content. This flaw is a direct result of insufficient handling of erroneous payment processing and bypasses the intended registration workflow.

The vulnerability affects the WordPress plugin WP User Manager versions 2.9.0 through 2.9.19. Administrators using any of these release versions that have enabled payment‑gated registration are at risk. The issue is limited to the plugin itself and does not involve the core WordPress authentication system.

The CVSS exploitation vector is not publicly documented, but the flaw is exploitable by an unauthenticated user on any site running the affected plugin version. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. Because an attacker can simply visit the registration page and complete the process with a fake payment, the likelihood of exploitation is moderate. Once an unauthorized account is created, the attacker could use it to access any content or resources that rely on standard WordPress role permissions, thus impacting confidentiality, integrity, and availability of the site.