A missing capability check in the WP User Manager plugin allows any authenticated user with Subscriber-level access or higher to invoke a Stripe Connect callback that writes credentials into the site's settings. The attacker can replace the publishable key, secret key, gateway mode and connected account ID, causing all future Stripe transactions to be processed through the attacker’s Stripe account. This flaw represents a missing authorization weakness that can compromise confidentiality and integrity of payment information.

WordPress sites that use the WP User Manager – User Profile Builder & Membership plugin, versions 2.9.18 and earlier. Any site running the plugin without an upgraded version is vulnerable.

The CVSS score of 4.3 indicates a low to medium severity, and the EPSS score is not available, so there is no current evidence of exploitation. The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack vector is inferred to be via the admin_init hook, which runs for any authenticated /wp-admin/ request—including Subscribers—without performing a capability check or nonce verification.