Executive brief
A popular WordPress plugin used for managing user registrations and memberships contains a security flaw that allows users to delete files they do not own. An attacker with a basic account on the site could exploit this to permanently remove images or documents uploaded by other users, including site administrators. This can lead to data loss and disruption of website content.
Technical details
The vulnerability is classified as an Insecure Direct Object Reference (IDOR) due to missing ownership validation on user-controlled attachment IDs within the plugin's frontend logic. Specifically, the plugin allows users to store and subsequently delete media attachments without verifying if the requesting user is the owner of the referenced ID. An authenticated attacker with subscriber-level permissions or higher can exploit this to permanently delete any media file in the WordPress library, including those uploaded by administrators. The issue is fixed in version 5.2.0.
Affected products
- WPEverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Up to and including 5.1.5
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
References
- https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/frontend/class-ur-frontend.php
- https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/frontend/class-ur-frontend.php
- https://plugins.trac.wordpress.org/browser/user-registration/trunk/includes/functions-ur-core.php
- https://plugins.trac.wordpress.org/changeset/3539426/user-registration/tags/5.2.0/includes/frontend/class-ur-frontend.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/0def7637-edf4-4ae2-a2e7-31ccb3b52d71?source=cve