What is GHSA-v7wr-g973-rw99?

GHSA-v7wr-g973-rw99 is a security advisory published by GitHub Security Advisories with Medium severity. The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it...

Which CVE IDs does GHSA-v7wr-g973-rw99 cover?

GHSA-v7wr-g973-rw99 covers the following CVE IDs: CVE-2026-110527. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-v7wr-g973-rw99?

GHSA-v7wr-g973-rw99 has a CVSS v3 base score of 5.3, published by GitHub Security Advisories.

GHSA-v7wr-g973-rw99MediumCVSS 5.3

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it...

Vendor

GitHub Security Advisories

Published

October 17, 2026

Last Modified

October 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-110527 →

📋 Description

The WP User Manager WordPress plugin before 2.9.20 does not roll back the WordPress account it creates during payment-gated registration when the subsequent payment step fails, allowing unauthenticated users to create functional accounts without completing payment.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-110527
https://wpscan.com/vulnerability/a9368969-cc1c-48b7-aa39-94a4d3c50669
https://github.com/advisories/GHSA-v7wr-g973-rw99