CVE-2026-18345 is a missing authorization vulnerability (CWE-862) in the WP User Manager plugin for WordPress, affecting versions up to 2.9.18. The Connect::complete() function, registered on the admin_init hook, executes for any authenticated user accessing /wp-admin/, including Subscribers, without verifying user capabilities or nonces. This function fetches Stripe credentials from an external service and updates the wpum_settings option with sensitive Stripe keys and account IDs. As a result, an attacker with low-level authenticated access can hijack the Stripe integration by completing their own OAuth flow and triggering the callback, causing payments to be routed to the attacker's Stripe account.

The vulnerability allows authenticated users with minimal privileges (Subscriber-level) to hijack the site's Stripe payment integration. This can lead to financial fraud where payments intended for the legitimate site owner are redirected to the attacker's Stripe account. There is no impact on confidentiality or availability reported, but the integrity of payment processing is compromised.

No official patch or vendor advisory is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to /wp-admin/ to trusted users only and monitor for suspicious Stripe OAuth activity. Avoid granting Subscriber or higher roles to untrusted users.