Executive brief
The User Registration & Membership WordPress plugin allows low-privilege users (Subscriber level and above) to cancel pending email changes for any user account, including administrators, without proper authorization checks. An attacker can prevent legitimate users from completing email address changes, disrupting account management and potentially locking administrators out of email-based account recovery.
Technical details
This is an Insecure Direct Object Reference (IDOR) vulnerability in the plugin's email change cancellation functionality. The vulnerable endpoint (user_registration_cancel_email_change AJAX action) accepts a user ID parameter but does not verify that the authenticated user owns the account being modified; it only validates the CSRF nonce. An attacker with any Subscriber-level account can craft a request targeting another user's ID, canceling their pending email change. The fix is to add authorization checks ensuring the authenticated user can only cancel their own pending email changes. The vulnerability is fixed in version 5.2.5.
Affected products
- Wordpress.org User Registration & Membership before 5.2.5
Timeline
- 2026-08-26: disclosed
- 2026-08-28: patched: Fixed in version 5.2.5