Unauthorized Data Modification in WP User Manager for WordPress

CVE-2026-18345

What is CVE-2026-18345?

The WP User Manager plugin for WordPress has a security flaw that allows authenticated users to modify sensitive data due to the absence of proper capability checks. Specifically, the Connect::complete() function does not perform required user permissions verification before accessing and updating Stripe-related credentials in the site's settings. This vulnerability enables attackers, with subscriber-level access or higher, to manipulate Stripe integrations by completing their own OAuth flow and redirecting payments to their own accounts, potentially leading to financial fraud and data loss.

References