WordPress Plugin Payment Bypass Grants Unauthorized Admin Access

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The WP User Manager plugin contains a critical privilege escalation vulnerability that allows unauthenticated users to bypass payment requirements and obtain administrator-level access. When a payment gateway is disconnected, the plugin fails to enforce its paid-registration restrictions, yet continues to process registration forms that assign privileged roles. This means attackers can simply register through a public form and immediately gain admin capabilities without completing any payment, effectively converting a gated premium feature into an open door for account compromise. Organizations using this plugin are exposed to immediate account takeover, data exfiltration, and complete site compromise—making this a high-impact flaw affecting any WordPress installation relying on paid membership models.

Casky's 224 matched skills leverage Claude's extended reasoning to identify the attack chain underlying MITRE technique TA0004 (Privilege Escalation). A practitioner monitoring their environment would see Casky flag suspicious registration patterns: authenticated admin accounts appearing immediately after unauthenticated POST requests to registration endpoints, role assignments occurring without corresponding payment records, and disconnected payment gateway logs correlating with unexpected privilege grants. The skills analyze authentication and authorization anomalies by correlating user creation timestamps, role assignments, and payment transaction logs—surfacing the logical contradiction that admin accounts exist without payment completion. By mapping this to CWE-269 (Improper Access Control), Casky helps practitioners understand that this isn't just a missing validation; it's a broken trust boundary where payment status is decoupled from role enforcement, enabling rapid detection of exploitation attempts in real time.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-110523.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-110523

Casky has 224 skills that investigate the attack patterns behind CVE-2026-110523. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn