CyberSecBulletin

WP User Manager vulnerabilities

We track 2 vulnerabilities in WP User Manager products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on October 21, 2026.

2vulnerabilities
1critical
1high
0exploited
8.9average CVSS score

Latest WP User Manager vulnerabilities

  • 8.1 High severity

    WP User Manager: Improper Privilege Management

    CVE-2026-110523WP User Manager

    The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthe

  • 9.8 Critical severity

    WP User Manager: Deserialization of Untrusted Data

    CVE-2025-60245WP User Manager

    Deserialization of Untrusted Data vulnerability in WP User Manager WP User Manager wp-user-manager allows Object Injection.This issue affects WP User Manager: from n/a through <= 2.9.12.