User Registration & Membership CVE-2026-11966

The target WordPress site must have the User Registration & Membership plugin installed and active in a version from 4.2.3 through 5.2.3 (exclusive), and the membership payment functionality must be in active use - sites using the plugin purely for free registration without payment flows may not expose the vulnerable action. Exploitation is limited to accounts in the transient 'recently registered, payment pending' state; already-activated or fully-paid accounts are not affected, narrowing the pool of targetable objects at any given moment. No authentication, WordPress nonce, or session is required (PR:N confirmed by CVSS vector). The primary limiting factor on impact is the narrow account-state prerequisite: an attacker cannot delete arbitrary established user accounts, only those awaiting payment confirmation.

The CVSS 3.1 base score of 5.3 Medium with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N accurately reflects a network-accessible, zero-friction exploitation path with limited impact scope - only integrity is affected, and only for a narrow class of account states. The EPSS score of 0.14% (3rd percentile) suggests that despite the low attack complexity and PR:N vector, mass exploitation has not been observed at the time of analysis; this is not unusual for WordPress plugin IDOR flaws that affect a narrow subset of target data. Counterbalancing the low EPSS, SSVC classifies the vulnerability as automatable:yes - meaning an attacker can script reliable exploitation at scale without human-in-the-loop steps - and a publicly available POC (via WPScan) lowers the bar further. This vulnerability is not listed in the CISA KEV catalog, so confirmed active exploitation is not established. On balance, this is a genuine medium-priority issue: real harm (disrupting user onboarding flows, suppressing registrations) is achievable at scale against unpatched sites, but attacker motivation is limited compared to flaws enabling data exfiltration or remote code execution. Sites running membership-commerce workflows are at higher practical risk than informational sites.

An unauthenticated attacker who has identified a WordPress site running the vulnerable plugin (detectable via standard plugin enumeration) sends a crafted HTTP request to the membership payment action endpoint with an incremented or guessed user ID targeting accounts in a payment-pending state. Using the publicly available WPScan POC, this process can be automated to enumerate and delete multiple pending registrations in rapid succession, disrupting user onboarding for affected sites. No credentials, cookies, or prior interaction with the site are required.