CVE-2026-79995 in User Registration & Membership Plugin
Summary
by MITRE • 08/28/2026
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within the User Registration & Membership WordPress plugin prior to version 5.2.5 represents a critical failure in object level authorization controls. This flaw specifically affects the functionality designed to allow users to cancel pending changes to their registered email addresses. In standard web application workflows, when a user initiates an email change, the system typically places this request in a pending state until confirmed via a link sent to the new address. The intended security model dictates that only the owner of the account should have the authority to abort or modify such sensitive identity changes. However, due to insufficient validation logic within the plugin's backend processing routines, the application fails to verify that the user initiating the cancellation request is indeed the same entity whose email change is being targeted for removal.
From a technical perspective, this deficiency constitutes an Insecure Direct Object Reference vulnerability as defined by CWE-639. The underlying mechanism likely relies on passing identifiers such as user IDs or pending token hashes in HTTP requests without cross-referencing them against the session identity of the authenticated actor making the request. Consequently, any authenticated user possessing Subscriber-level access and above can manipulate these parameters to target arbitrary accounts within the system. This lack of ownership verification allows an attacker with minimal privileges to interfere with administrative processes by cancelling email change requests belonging to higher-privileged users, including administrators.
The operational impact of this vulnerability extends beyond simple disruption of service. By canceling a pending email change for an administrator or other privileged user, an attacker can effectively lock the victim out of their account if they have already initiated a transition to a new email address that has not yet been confirmed. This action disrupts the authentication flow and may force the administrative user into a password reset cycle, thereby causing denial of service conditions for critical system management functions. Furthermore, in scenarios where multiple users are managing sensitive data or compliance-related tasks tied to specific email identities, this manipulation can lead to significant operational inconsistencies and potential breaches of audit trails that rely on accurate user identity mapping.
This behavior aligns with the ATT&CK technique T1078, specifically Valid Accounts, as it leverages legitimate credentials to perform unauthorized actions against other accounts within the same environment. It also reflects aspects of privilege escalation through functional abuse, where low-privilege users exploit logic flaws to interfere with high-privilege workflows. The ability to disrupt administrative account management undermines the integrity of role-based access control mechanisms inherent in WordPress installations and similar content management systems that depend on distinct user roles for security segmentation.
To mitigate this vulnerability, immediate action is required by updating the User Registration & Membership plugin to version 5.2.5 or later, where these authorization checks have been properly implemented. Administrators should ensure that all plugins are kept up to date with vendor-released patches addressing authentication and authorization flaws. Additionally, implementing strict server-side validation for every state-changing operation is essential. Developers must enforce object ownership verification by comparing the user ID associated with the pending action against the authenticated session ID of the requester before processing any cancellation or modification requests. This ensures that users can only interact with resources they legally own, thereby closing the gap exploited in this vulnerability and restoring trust in the application's access control model.