CVE-2026-9290

CVE-2026-9290 — Exploit de LFI a RCE en WP User Manager Path Traversal sin autenticación a través del parámetro 'tab' → Inclusión Local de Archivos LFI Resumen CVE-2026-9290 es una vulnerabilidad de Inclusión Local de Archivos LFI sin autenticación, de severidad alta CVSS 7.5, en el plugin de...

CVE-2026-103085

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

CVE-2026-103085 WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

CVE-2026-103085

The WP User Manager plugin for WordPress (versions

EUVD-2026-92582

Improper Access Control vulnerability in WP User Manager WP User Manager wp-user-manager allows Privilege Abuse.This issue affects WP User Manager: from n/a through 2.9.20...

WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

Privilege Escalation vulnerability discovered by Pedro Delgado in WordPress Plugin WP User Manager versions = 2.9.20...

CVE-2026-94079

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

CVE-2026-94079

The WP User Manager plugin for WordPress, affecting versions

CVE-2026-94079 WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

CVE-2026-94079 WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

EUVD-2026-85469

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

CVE-2026-94079: Missing Authorization

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

PT-2026-97454

Unauthenticated Broken Access Control in WP User Manager = 2.9.19 versions...

WordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin WP User Manager versions = 2.9.19...

CVE-2026-18345

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-18345 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-18345 WP User Manager <= 2.9.18 - Missing Authorization to Authenticated (Subscriber+) Stripe Account Hijack via Stripe Connect Callback

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

CVE-2026-18345

The WP User Manager plugin for WordPress (versions up to and including 2.9.18 ) is vulnerable to unauthorized data modification due to a missing capability check in the Connect::complete() function. This function is registered on the admin_init hook and fails to perform current_user_can() or nonc...

CVE-2026-18345: Missing Authorization

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete function in versions up to, and including, 2.9.18. The function is registered on the admininit hook which fires for every authenticated user that...

PT-2026-96662

Name of the Vulnerable Software and Affected Versions WP User Manager versions prior to 2.9.19 Description The plugin allows unauthorized modification of data because the Connect::complete function lacks a capability check. This function is registered on the admin init hook, which executes for an...