CVE-2026-11966 is an authorization bypass vulnerability in the User Registration & Membership WordPress plugin prior to version 5.2.3. The plugin fails to perform capability checks for unauthenticated callers on a membership payment action, allowing attackers to specify a user identifier and delete payment-pending user accounts without authentication. This issue is categorized under CWE-639 (Authorization Bypass Through User-Controlled Key). No CVSS score or official remediation level is provided, and no patch information is currently available.

Unauthenticated attackers can delete recently-registered user accounts that are pending payment, potentially disrupting user registrations and causing denial of service to legitimate users. There is no indication of further privilege escalation or data disclosure from the provided information.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected membership payment actions if possible or monitor for suspicious activity related to user deletions. Avoid relying on this plugin version in production environments where user account integrity is critical.