What is the CVSS score of CVE-2026-7651?

CVE-2026-7651 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

User Registration & Membership CVE-2026-7651

EUVD-2026-32730 MEDIUM

Authorization Bypass Through User-Controlled Key (CWE-639)

2026-05-28 Wordfence

GHSA-xc7f-h2v5-wx39

WordPress Authentication Bypass User Registration Membership Free Paid Memberships Subscriptions Content Restriction User Profile Custom User Registration Login Builder Wordpress Plugin Wpeverest

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 28, 2026 - 07:53 vuln.today

CVE Published

May 28, 2026 - 06:45 nvd

MEDIUM 5.3

DescriptionCVE.org

The User Registration & Membership - Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.5. This is due to missing ownership validation on a user-controlled attachment ID, allowing the plugin to store and subsequently delete arbitrary media attachments without verifying that the referenced attachment belongs to the requesting user. This makes it possible for authenticated attackers, with subscriber-level access and above, to permanently delete arbitrary media attachments uploaded by any other user, including administrators.

AnalysisAI

Insecure Direct Object Reference in WPEverest's User Registration & Membership WordPress plugin (all versions through 5.1.5) allows deletion of arbitrary media attachments by exploiting missing ownership validation on user-controlled attachment IDs. Authenticated users at subscriber level or above can permanently destroy any media file uploaded by any other user, including administrators, by submitting a crafted attachment ID to the plugin's frontend handler. No public exploit has been identified at time of analysis, and this is not listed in CISA KEV; however, the low barrier to exploitation - any registered site user qualifies - elevates practical risk on membership-driven WordPress sites.

Technical ContextAI

The vulnerability resides in the WPEverest User Registration & Membership plugin (CPE: cpe:2.3:a:wpeverest:user_registration_&_membership_...:*:*:*:*:*:*:*:*) and is rooted in CWE-639 (Authorization Through User-Controlled Key). The plugin's frontend class (class-ur-frontend.php, lines 86 and 114) accepts a user-supplied attachment ID parameter and passes it to a core function (functions-ur-core.php, line 4262) that stores and subsequently deletes the referenced WordPress media attachment without verifying that the attachment's owner matches the requesting user. WordPress's own attachment model stores author ownership metadata, but the plugin bypasses this check entirely, trusting the caller-supplied integer ID as authoritative. This is a classic IDOR pattern where the authorization boundary exists in the data model but is never enforced at the application layer.

RemediationAI

Upgrade to User Registration & Membership version 5.2.0 or later, which introduces ownership validation in the attachment handling logic as confirmed by the Trac changeset at plugins.trac.wordpress.org/changeset/3539426/user-registration/tags/5.2.0/includes/frontend/class-ur-frontend.php. If immediate upgrade is not possible, the primary compensating control is to disable open user registration on the WordPress site (Settings > General > uncheck 'Anyone can register'), which eliminates the subscriber-level account creation path that enables exploitation - though this trade-off prevents legitimate new member signups. Alternatively, site administrators can audit media library ownership and restrict attachment management capabilities via a capability-management plugin, though this does not patch the underlying code path. Monitoring WordPress error logs and attachment deletion events for anomalous activity by low-privilege users is advisable until patched.