Description

The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() function in versions up to, and including, 2.9.18. The function is registered on the admin_init hook (which fires for every authenticated user that reaches /wp-admin/, including Subscribers) and performs no current_user_can() or nonce verification before fetching Stripe credentials from the external WPUM connect service and writing them (publishable key, secret key, gateway mode, and connected Stripe account ID) into the wpum_settings option via wpum_update_option()/update_option(). This makes it possible for authenticated attackers, with Subscriber-level access and above, to hijack the site's Stripe integration by completing their own Stripe Connect OAuth flow and then invoking the callback on the target site, causing all subsequent Stripe payments to be routed to the attacker's Stripe account.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-22T08:16:38.940Z",
  "pubdate": "2026-09-22T08:16:38.940Z",
  "executiveSummary": "The WP User Manager plugin for WordPress is susceptible to an unauthorized modification of data vulnerability that allows authenticated users to hijack the site's Stripe payment integration. This flaw stems from an improper implementation of access control mechanisms within the plugin's Stripe Connect functionality.\nThe vulnerability is categorized as an authorization bypass, where the Connect::complete() function lacks essential capability checks and nonce validation. As this function is hooked into admin_init, it executes for any authenticated user, including those with minimal privileges such as Subscribers.\nBy successfully triggering the callback mechanism, an attacker can overwrite the site's Stripe configuration settings, including the publishable key, secret key, gateway mode, and connected account ID. This results in the complete redirection of all subsequent customer payments from the legitimate site owner to an attacker-controlled Stripe account.\nThe risk implication is critical, as it allows for immediate financial theft and potential business disruption. Exploitation requires no special privileges beyond standard subscriber-level authentication. The vulnerability affects WP User Manager versions up to and including 2.9.18.",
  "technicalDetails": "The vulnerability resides within the Connect::complete() method, which is intended to finalize the Stripe Connect OAuth handshake. The root cause is the absence of security primitives—specifically, the lack of current_user_can() authorization checks and cryptographic nonce verification—within the callback handler.\nBecause the function is registered via the admin_init hook, it is executed whenever an authenticated user accesses the WordPress administrative dashboard. Since the hook fires for all user roles, the plugin fails to enforce the principle of least privilege, exposing administrative functions to non-administrative actors.\nThe attack flow begins when an attacker, authenticated as a Subscriber, initiates the Stripe Connect OAuth process. The attacker then triggers the Connect::complete() function by accessing the specific endpoint or callback URL associated with the plugin's Stripe integration. Because there is no nonce verification, the request is not protected against cross-site request forgery (CSRF) or unauthorized direct invocation.\nUpon execution, the vulnerable function retrieves Stripe credentials—such as the secret key, publishable key, and Stripe account ID—through an external interaction with the WPUM connect service. It subsequently persists these values into the database using wpum_update_option() (which wraps the standard update_option() function) in the wpum_settings option group.\nThe payload effectively replaces the legitimate site's Stripe configuration with the attacker's own Stripe Connect credentials. Once the database is updated with the malicious configuration, the plugin uses these injected credentials for all subsequent payment processing. This results in a complete hijacking of the payment flow, where financial transactions intended for the legitimate site are intercepted by the attacker’s Stripe account.\nThe attack surface is exposed to any authenticated user with access to the WordPress backend. The post-exploitation impact is severe, as the attacker gains full control over the financial gateway configuration, leading to direct loss of revenue and potential exposure of sensitive transactional data. Given the lack of input sanitization or verification, the state change is immediate and persistent until the administrator manually intervenes to revert the settings."
}