Description

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-28T08:16:42.337Z",
  "pubdate": "2026-08-28T08:16:42.337Z",
  "executiveSummary": "The User Registration & Membership WordPress plugin, in versions prior to 5.2.5, contains an Insecure Direct Object Reference (IDOR) vulnerability related to pending email change requests.\nThe vulnerability originates from a failure to perform server-side authorization checks to verify ownership of an account undergoing an email change process.\nAn authenticated attacker with at least Subscriber-level privileges can cancel the pending email change requests of any other user, including administrative accounts.\nThis flaw allows malicious actors to disrupt account security operations and interfere with the administrative lifecycle of the WordPress instance.\nThe vulnerability is reachable by any logged-in user, and successful exploitation requires no special interaction from the victim beyond the existence of a pending change request.\nThis represents a significant integrity risk to the user management functions of the plugin.",
  "technicalDetails": "The root cause of this vulnerability is an authorization bypass within the plugin's logic for processing email change cancellations. While the plugin provides functionality to allow users to abort a requested email change, the underlying handler fails to validate the current user's session against the ID of the target account for which the cancellation is requested.\nIn a secure implementation, the backend should verify that the user ID associated with the email change request matches the unique identifier of the authenticated user session attempting the cancellation. Because this verification step is absent, the application accepts requests for any valid ID associated with a pending email transition.\nAttack flow: 1. An attacker identifies a target user (e.g., an administrator) who has initiated an email change. 2. The attacker observes the network request structure used by the plugin to invoke the email change cancellation action. 3. The attacker constructs a crafted HTTP request, typically a POST request, targeting the cancellation endpoint with a parameter representing the target user's account identifier (e.g., user_id). 4. Upon submission, the plugin fails to check if the session owner matches the specified user_id, processes the request, and updates the database to purge the pending change. 5. The target user is effectively denied the ability to update their email address, and their account state is reverted or altered without their consent.\nThis flaw is categorized as an IDOR vulnerability, specifically affecting the administrative functions of the plugin. It is accessible via the standard web interface for any authenticated user. The vulnerability does not require administrative privileges to initiate the attack; only a basic Subscriber-level account is necessary to exploit the lack of access control checks.\nThe scope of impact is limited to the integrity of the email change workflow. While this does not grant direct privilege escalation, it allows for the malicious disruption of security-critical user account maintenance, potentially causing administrative friction or forcing users to repeat sensitive security processes, which could be leveraged in further social engineering or denial-of-service scenarios."
}