WordPress plugin
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 21 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical0
- High6
- Medium15
- Low0
All WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.3 | 2.9.25 - Unauthenticated Privilege Escalation 2.9.21 – 2.9.25Update to 2.9.26 | CVE-2026-110523 | |
| High7.3 | Unauthenticated Privilege Escalation ≤2.9.20Update to 2.9.21 | CVE-2026-103085 | |
| High7.5 | Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter ≤2.9.17Update to 2.9.18 | CVE-2026-9290 | |
| High8.1 | Authenticated (Subscriber+) Arbitrary File Deletion ≤2.9.16Update to 2.9.17 | CVE-2026-49766 | |
| High7.5 | Authenticated (Subscriber+) PHP Object Injection ≤2.9.12Update to 2.9.13 | CVE-2025-60245 | |
| High7.5 | Arbitrary User Password Reset ≤2.6.2Update to 2.6.3 | CVE-2021-24655 |
- High7.32.9.25 - Unauthenticated Privilege Escalation
2.9.21 – 2.9.25Update to 2.9.26
- High7.3Unauthenticated Privilege Escalation
≤2.9.20Update to 2.9.21
- High7.5Unauthenticated Path Traversal to Local File Inclusion via 'tab' Query Parameter
≤2.9.17Update to 2.9.18
- High8.1Authenticated (Subscriber+) Arbitrary File Deletion
≤2.9.16Update to 2.9.17
- High7.5Authenticated (Subscriber+) PHP Object Injection
≤2.9.12Update to 2.9.13
- High7.5Arbitrary User Password Reset
≤2.6.2Update to 2.6.3
WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory: common questions
Does WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory have known vulnerabilities?
Yes. VulnCrest Radar lists 21 known vulnerabilities in WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory: 6 high, 15 medium. None are known to affect version null.
How do I check which version of WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerability?
CVE-2026-124413, published Nov 11, 2026: WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory <= 2.10.4 - Missing Authorization. Severity: Medium (CVSS 5.3).
Is any WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerability listed in CISA KEV?
No. None of the known WP User Manager – Registration Form, Login Form, User Profile Builder & Member Directory vulnerabilities is currently listed in the CISA KEV catalog.