CVE-2026-18345
Received Received - Intake

Unauthorized Stripe Credential Modification in WP User Manager

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: Wordfence

Description
The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-18345
EUVD
EUVD-2026-84307

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wp_user_manager wp_user_manager to 2.9.18 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The WP User Manager plugin for WordPress has a vulnerability where an attacker with Subscriber-level access or higher can modify site settings without proper authorization. The Connect::complete() function lacks a capability check, allowing attackers to hijack the site's Stripe integration by completing their own OAuth flow and redirecting payments to their Stripe account.

Detection Guidance

Check for unauthorized modifications to the wpum_settings option in the WordPress database. Look for unexpected Stripe credentials or changes to payment gateway settings. Review WordPress logs for admin_init hook invocations by non-admin users.

Impact Analysis

This vulnerability allows attackers to take control of your site's Stripe payments. If exploited, all future payments would be sent to the attacker's Stripe account instead of yours, leading to financial loss and potential data breaches of customer payment information.

Compliance Impact

This vulnerability could lead to non-compliance with GDPR and HIPAA by exposing sensitive payment data to unauthorized parties. GDPR requires protecting personal data, and HIPAA mandates securing financial transactions, both of which are violated if payments are redirected to attackers.

Mitigation Strategies

Update the WP User Manager plugin to the latest version. Remove Subscriber-level access if not required. Monitor wpum_settings for unauthorized changes. Revoke any suspicious Stripe credentials in your Stripe dashboard.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18345. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart