opnsense-uidfield-system-uid0

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · opnsense-uidfield-system-uid0 opnsense-uidfield-system-uid0 Class: Privilege leftover Reach: Remote OPNsense core 26.7.6 a842fe48 - opnsense.org Delegated page-system-usermanager two-steps scope=system then uid=0...

CVE-2026-9290

CVE-2026-9290 — WP User Manager LFI to RCE Exploit Pre-Auth Path Traversal via 'tab' Parameter → Local File Inclusion Overview CVE-2026-9290 is a high-severity CVSS 7.5 unauthenticated Local File Inclusion vulnerability in the WP User Manager – User Profile Builder & Membership WordPress plugin ≤...

WordPress WP User Manager plugin 2.9.21-2.9.25 - Unauthenticated Privilege Escalation vulnerability

Unauthenticated Privilege Escalation vulnerability discovered by Charles Vosburgh in WordPress Plugin WP User Manager versions 2.9.21-2.9.25...

CVE-2026-110523

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

CVE-2026-110523

The WP User Manager WordPress plugin versions prior to 2.9.26 is vulnerable to unauthenticated privilege escalation . The flaw occurs because the plugin fails to maintain paid-registration restrictions once a payment gateway is disconnected. Consequently, a published paid registration form will s...

EUVD-2026-107069

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

CVE-2026-110523 WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

CVE-2026-110523 WP User Manager 2.9.21 - 2.9.25 - Unauthenticated Privilege Escalation via Paid Registration Role After Stripe Disconnect

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

PT-2026-120464

The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and...

CVE-2026-112823

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25...

EUVD-2026-105142

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25...

CVE-2026-112823

The WP User Manager WordPress plugin (versions n/a through 2.9.25 ) is vulnerable to a Broken Access Control issue. This Missing Authorization vulnerability (CWE-862) allows an attacker to manipulate user states . While the vulnerability is reachable over the network with low complexity, it requi...

CVE-2026-112823 WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability

Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25...

WordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by ssophiz in WordPress Plugin WP User Manager versions = 2.9.25...

WordPress WP User Manager plugin 2.9-2.9.19 - Unauthenticated Account Creation vulnerability

Unauthenticated Account Creation vulnerability discovered by Sanjorn Keeratirungsan in WordPress Plugin WP User Manager versions 2.9-2.9.19...

CVE-2026-110527

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment...

CVE-2026-110527

The WP User Manager WordPress plugin, in versions prior to 2.9.20 , contains a vulnerability where it fails to roll back a WordPress account created during payment-gated registration if the subsequent payment step fails. This flaw allows unauthenticated users to successfully create functional acc...

EUVD-2026-103257

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment...

CVE-2026-110527 WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment...

CVE-2026-110527 WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment...