HomeWordPress vulnerabilitiesWP User Manager
WP User Manager vulnerabilities
WP User Manager has 7 known vulnerabilities in this database. The most recent published record is dated 5 Oct 2026.
- Known vulnerabilities
- 7
- Active installs
- 10,000+
- Latest version
- 2.9.21
- Last updated
- 1 Oct 2026
- Most recent
- 5 Oct 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Privilege escalation CVE-2026-103085 | Medium 6.5 | Up to 2.9.20 | Fixed in a later version (latest 2.9.21) | 2 d ago |
| Broken access control CVE-2026-18345 | Medium 4.3 | Up to 2.9.18 | Fixed in a later version (latest 2.9.21) | 22 Sep 2026 |
| File inclusion CVE-2026-9290 | High 7.5 | Up to 2.9.17 | Fixed in a later version (latest 2.9.21) | 6 Jun 2026 |
| Remote code execution CVE-2025-13320 | Medium 6.8 | Up to 2.9.12 | Fixed in a later version (latest 2.9.21) | 12 Dec 2025 |
| Broken access control CVE-2024-10216 | Medium 4.3 | Before 2.9.12 | Fixed in 2.9.12 | 23 Nov 2024 |
| Broken access control CVE-2024-10537 | Medium 4.3 | Before 2.9.12 | Fixed in 2.9.12 | 23 Nov 2024 |
| Broken access control CVE-2021-24655 | High 7.5 | Before 2.6.3 | Fixed in 2.6.3 | 17 Jul 2022 |
Read the published descriptions
- CVE-2026-103085, 5 Oct 2026
- Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20. CVE record
- CVE-2026-18345, 22 Sep 2026
- The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account. CVE record
- CVE-2026-9290, 6 Jun 2026
- The WP User Manager - User Profile Builder & Membership plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.9.17 via the (profile template scope) function. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included. CVE record
- CVE-2025-13320, 12 Dec 2025
- The WP User Manager plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 2.9.12. This is due to insufficient validation of user-supplied file paths in the profile update functionality combined with improper handling of array inputs by PHP's filter_input() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary files on the server via the 'current_user_avatar' parameter in a two-stage attack which can make remote code execution possible. This only affects sites with the custom avatar setting enabled. CVE record
- CVE-2024-10216, 23 Nov 2024
- The WP User Manager - User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'add_sidebar' and 'remove_sidebar' functions in all versions up to, and including, 2.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to add or remove a Carbon Fields custom sidebar if the Carbon Fields (carbon-fields) plugin is installed. CVE record
- CVE-2024-10537, 23 Nov 2024
- The WP User Manager - User Profile Builder & Membership plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the validate_user_meta_key() function in all versions up to, and including, 2.9.11. This makes it possible for authenticated attackers, with Subscriber-level access and above, to enumerate user meta keys. CVE record
- CVE-2021-24655, 17 Jul 2022
- The WP User Manager WordPress plugin before 2.6.3 does not ensure that the user ID to reset the password of is related to the reset key given. As a result, any authenticated user can reset the password (to an arbitrary value) of any user knowing only their ID, and gain access to their account. CVE record
What to do if you run WP User Manager
If you run WP User Manager, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new WP User Manager vulnerabilities
Free. We email you when a new vulnerability is published for WP User Manager, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.