Veille CVE

Semaine du 19 octobre au 25 octobre 2026

2 CVE

Critique 0 Élevée 1 Moyenne 1 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « WP User Manager » ✕
  1. CVE-2026-110523 8.1 Élevée

    Unknown WP User Manager

    The WP User Manager WordPress plugin before 2.9.26 does not keep its paid-registration capability restrictions in force once the payment gateway is disconnected, while a published paid registration form continues to assign its configured role, allowing unauthenticated users to register and immediately obtain a privileged administrator-equivalent role without completing the payment meant to gate it.

  2. CVE-2026-112823 4.3 Moyenne

    WP User Manager

    Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.