EUVD-2026-45147
GHSA-2wp6-4gxm-vfvx
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-accessible with no auth (PR:N) or interaction (UI:N); impact limited to integrity of a narrow pending-account state, no confidentiality or availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
4DescriptionCVE.org
The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.
AnalysisAI
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) exposes a membership payment action endpoint that performs no capability check on the caller, allowing any unauthenticated remote attacker to supply an arbitrary user identifier and delete recently-registered, payment-pending accounts. The flaw is a classic CWE-639 Insecure Direct Object Reference - the plugin trusts a caller-supplied user ID without verifying the caller has authority to act on it. A publicly available proof-of-concept exists, and SSVC classifies exploitation as automatable, though the EPSS score of 0.14% (3rd percentile) indicates limited observed exploitation volume at the time of analysis.
Technical ContextAI
The vulnerability resides in the User Registration & Membership WordPress plugin (CPE: cpe:2.3:a:unknown:user_registration_&_membership:*:*:*:*:*:*:*:*), a plugin providing self-service registration and payment-gated membership workflows on WordPress sites. CWE-639 (Authorization Bypass Through User-Controlled Key) identifies the root cause: the plugin exposes a server-side membership payment action that accepts a user identifier as a caller-supplied parameter and performs account operations without first invoking WordPress capability checks (e.g., current_user_can()) to validate whether the caller is authorized to act on behalf of that user. This pattern is a well-understood IDOR vulnerability class - the server treats possession of a valid-looking user ID as sufficient authorization. Because the action is accessible without authentication (PR:N in the CVSS vector), no WordPress nonce, session, or authentication token is required to trigger the operation. The impact is scoped to accounts in the specific transient state of 'recently registered and payment pending', which bounds but does not eliminate the integrity risk.
RemediationAI
The primary fix is to update the User Registration & Membership plugin to version 5.2.3 or later, which introduces the missing capability check on the membership payment action. Vendor patch availability is confirmed per the WPScan advisory (https://wpscan.com/vulnerability/8e3be064-b3b7-4d68-960b-8c850c3e6f77/) and NVD (https://nvd.nist.gov/vuln/detail/CVE-2026-11966). If immediate patching is not possible, a targeted compensating control is to use a WAF rule to block unauthenticated POST requests to the specific payment action parameter on the affected endpoint - this disrupts legitimate flows only if anonymous users legitimately trigger payment callbacks, so evaluate against your workflow before applying. Alternatively, temporarily disabling the membership payment feature via the plugin settings reduces exposure at the cost of halting new paid registrations. There are no known side effects to upgrading to 5.2.3 beyond the resolved security behavior.
More in User Registration Membership
View allThe User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their accou
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated att
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors s
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-priv
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows an
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allow
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user h
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holdin
Open redirect in the User Registration & Membership WordPress plugin before 5.2.8 permits unauthenticated attackers to c
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any auth
Unauthenticated information disclosure in the User Registration & Membership WordPress plugin (versions 5.0 through 5.2.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today