{"id":"CVE-2026-110527","revision":"ecd78def1c734a4bbd3adb9329d85602","records":[{"revision":"ecd78def1c734a4bbd3adb9329d85602","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-110527","aliases":[],"title":"WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass","description":"The WP User Manager  WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.","state":0,"publishedAt":"2026-10-17T06:00:14.648+00:00","modifiedAt":"2026-10-18T11:12:32.083+00:00","affected":[{"ecosystem":"Vendor product","name":"WP User Manager","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"WP User Manager\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"2.9\",\n                            \"lessThan\": \"2.9.20\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/a9368969-cc1c-48b7-aa39-94a4d3c50669/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-110527","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-110527","identifiers":["CVE-2026-110527"]},"retained":false,"historicalAffected":[]}],"coverage":[]}