User Registration & Membership CVE-2026-7651

Exploitation requires an authenticated WordPress account at subscriber level or higher - any user who has completed registration on the site qualifies. The plugin must be installed and active. Note that the CVSS vector specifies PR:N (no privileges required), which directly conflicts with the description's requirement for subscriber-level authentication; defenders should treat authentication as required pending vendor clarification of the vector. The vulnerability is exploited via the plugin's frontend attachment handler, meaning it is reachable over the network without additional configuration. Limiting factors include: the attacker must have a valid WordPress account (mitigated by disabling open registration), and the impact is limited to deletion of media attachments with no read access to file contents or credentials.

The NVD-assigned CVSS 3.1 score of 5.3 with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N presents a significant conflict with the CVE description: PR:N indicates no privileges are required, yet the description explicitly states 'authenticated attackers, with subscriber-level access and above.' This discrepancy must be verified against the vendor advisory - the vector appears to be miscalibrated, and the realistic effective PR should be PR:L (low privileges). Treating this as unauthenticated based on the vector alone would be incorrect. The integrity impact is limited (I:L) with no confidentiality or availability loss per CVSS, but permanent deletion of admin-uploaded media is a meaningful destructive capability on content-driven sites. No EPSS data was provided. KEV status is not confirmed; no public exploit has been identified at time of analysis. Real-world priority is moderate for WordPress sites using this plugin with open user registration, as any registered subscriber can silently destroy content assets.

An attacker registers a free subscriber account on a WordPress site running the vulnerable plugin, then enumerates attachment IDs by observing publicly embedded media URLs or iterating sequential integer IDs. The attacker submits crafted POST requests to the plugin's frontend endpoint supplying a victim's attachment ID, causing the plugin to permanently delete the targeted file - such as a product image, documentation PDF, or profile photo uploaded by an administrator - without any ownership check. No public exploit code has been identified at time of analysis, but the technique requires only basic knowledge of WordPress attachment ID structures.