CVE-2026-79995: 
WordPress vulnerability analysis and mitigation

CVE-2026-79995 is an Insecure Direct Object Reference (IDOR) vulnerability in the User Registration & Membership WordPress plugin that allows authenticated users with Subscriber-level access or above to cancel any other user's pending email change request, including an administrator's. It affects all versions of the plugin before 5.2.5 and was publicly disclosed on August 26, 2026. The vulnerability was discovered and reported by researcher Sai Praneeth Koti and assigned a CVSS score of 4.3 (Medium) (WPScan).

The root cause is an authorization bypass through a user-controlled key (CWE-639), classified under OWASP Top 10 A5: Broken Access Control. The plugin's email change cancellation functionality fails to verify that the account targeted for cancellation belongs to the authenticated user making the request, allowing any subscriber-level user to supply an arbitrary user ID or account reference to cancel another user's pending email change. This is a classic IDOR pattern where access control is enforced solely on authentication (is the user logged in?) rather than authorization (does this user own this resource?). A proof-of-concept is scheduled for public release on September 9, 2026, to allow time for users to update (WPScan).

Successful exploitation allows a low-privileged authenticated attacker to disrupt account management workflows for any user on the WordPress site, including administrators. By cancelling an administrator's pending email change, an attacker could interfere with account recovery or security update processes, potentially causing denial of service to account management functions or maintaining an administrator's account on an older, potentially compromised email address. While this vulnerability does not directly grant code execution or data exfiltration, it can be leveraged as part of a broader account takeover or social engineering campaign (WPScan).

The vulnerability requires authentication at the Subscriber level or above, which is a low barrier on sites with open user registration. No public exploit code has been released yet — WPScan has withheld the PoC until September 9, 2026, to allow time for patching. The EPSS score is reported as 0.0, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (WPScan, VulDB).

1. Reconnaissance: Identify a WordPress site running the User Registration & Membership plugin version below 5.2.5 with open user registration enabled.
2. Register or obtain a low-privilege account: Create or use an existing Subscriber-level (or higher) account on the target site.
3. Identify a target user: Determine the user ID or account identifier of a target user (e.g., an administrator) who has a pending email change in progress. This may be inferred through enumeration or social engineering.
4. Craft a malicious request: Send an authenticated HTTP request to the plugin's email change cancellation endpoint, supplying the target user's account identifier rather than the attacker's own, without any server-side ownership check being enforced.
5. Cancel the target's email change: The server processes the request and cancels the target user's pending email change, disrupting their account management workflow (WPScan).

• Logs: WordPress access logs showing authenticated POST/GET requests to the email change cancellation endpoint with user IDs that do not match the authenticated session's user ID.
• Logs: Repeated cancellation requests from a single low-privilege user account targeting multiple different user IDs in a short timeframe.
• Application Behavior: Administrators or other users reporting that their pending email change requests were unexpectedly cancelled without their action.

Update the User Registration & Membership WordPress plugin to version 5.2.5 or later, which contains the fix for this vulnerability. No configuration-based workaround has been published; upgrading is the only recommended remediation. Site administrators should also review user registration settings and consider restricting open registration if not required, to reduce the pool of potential attackers (WPScan).