User Registration & Membership CVE-2026-79995

Exploitation requires a valid WordPress account with at minimum Subscriber-level role on the target site - unauthenticated users cannot exploit this flaw (CVSS PR:L confirms authenticated access is mandatory). The target victim must have an active, pending email change in progress at the time of the attack; if no email change is pending, there is nothing to cancel. The attacker must also know or successfully enumerate the target user's identifier (typically a sequential WordPress user ID), which limits automation. No special server configuration is required - any default installation of the plugin in versions below 5.2.5 with at least one registered subscriber account is vulnerable when a privileged user has initiated but not yet confirmed an email change.

CVSS 3.1 rates this at 4.3 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N, reflecting network-accessible exploitation requiring only subscriber authentication with low integrity impact and no confidentiality or availability consequences. SSVC reinforces the limited urgency: exploitation is currently assessed as none, the attack is not automatable (an attacker must know or enumerate a target user's pending-change state), and technical impact is partial. A public exploit (WPScan PoC) exists, which elevates accessibility, but this does not translate to broad in-the-wild abuse per available signals. The real-world risk is constrained: the worst case is disrupting an administrator's email change workflow, potentially forcing them to re-initiate the process, rather than account takeover or data exfiltration. The 'Information Disclosure' tag in the intelligence data appears to be a misclassification - the CVSS vector shows C:N (no confidentiality impact) and the description confirms no data is leaked. This discrepancy should be noted; the actual harm is integrity-only (unauthorized state modification).

An authenticated WordPress subscriber enumerates or guesses an administrator's user ID while the administrator has a pending email address change in progress. The subscriber sends a crafted cancellation request to the plugin's endpoint with the administrator's user ID as the parameter; the server cancels the administrator's pending change without validating ownership. A public PoC is available via WPScan demonstrating this request manipulation.