Executive brief
A vulnerability in the User Registration & Membership plugin for WordPress allows unauthorized individuals to delete the accounts of new users who have registered but not yet completed their payment. This occurs because the plugin fails to verify the identity of the person requesting the action during the payment process. While established users and administrators are not affected, this can disrupt the registration process and prevent new members from joining the site.
Technical details
The User Registration & Membership plugin for WordPress (versions prior to 5.2.3) contains an Insecure Direct Object Reference (IDOR) vulnerability in its Stripe subscription handler. The 'user_registration_membership_create_stripe_subscription' AJAX action fails to perform a capability check and relies on a user-supplied 'member_id'. If a payment failure occurs (which can be forced with invalid credentials), the exception handler deletes the targeted user account. This attack is unauthenticated, though it requires a valid nonce that is publicly accessible on the registration page. The impact is limited to deleting accounts in a 'payment-pending' state; established users and administrators are not affected. The issue is fixed in version 5.2.3.
Affected products
- Unknown User Registration & Membership < 5.2.3
Timeline
- 2026-06-26: disclosed: Publicly published by WPScan
- 2026-07-17: advisory: NVD published date