CVE-2026-2356: CWE-284 Improper Access Control in wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2 via the 'register_member' function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that newly registered on the site who has the 'urm_user_just_created' user meta set.
AI Analysis
Technical Summary
The User Registration & Membership plugin for WordPress, versions up to 5.1.2, contains an insecure direct object reference vulnerability in the 'register_member' function. This occurs because the plugin fails to validate the 'member_id' parameter, which is user-controlled. As a result, unauthenticated attackers can delete arbitrary user accounts that have the 'urm_user_just_created' user meta set, effectively targeting newly created users. This vulnerability is categorized under CWE-284 (Improper Access Control) and has a CVSS 3.1 score of 5.3, indicating a medium severity level. No patch or official remediation information is currently available.
Potential Impact
An unauthenticated attacker can delete arbitrary user accounts that are newly registered on the affected WordPress site, specifically those with the 'urm_user_just_created' meta key. This could disrupt user access and potentially cause denial of service for affected users. There is no indication of confidentiality or availability impact beyond user account deletion. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should monitor for updates from the plugin vendor and consider restricting access to the affected functionality if possible. No vendor advisory or patch links are currently provided.
CVE-2026-2356: CWE-284 Improper Access Control in wpeverest User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder
Description
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2 via the 'register_member' function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that newly registered on the site who has the 'urm_user_just_created' user meta set.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The User Registration & Membership plugin for WordPress, versions up to 5.1.2, contains an insecure direct object reference vulnerability in the 'register_member' function. This occurs because the plugin fails to validate the 'member_id' parameter, which is user-controlled. As a result, unauthenticated attackers can delete arbitrary user accounts that have the 'urm_user_just_created' user meta set, effectively targeting newly created users. This vulnerability is categorized under CWE-284 (Improper Access Control) and has a CVSS 3.1 score of 5.3, indicating a medium severity level. No patch or official remediation information is currently available.
Potential Impact
An unauthenticated attacker can delete arbitrary user accounts that are newly registered on the affected WordPress site, specifically those with the 'urm_user_just_created' meta key. This could disrupt user access and potentially cause denial of service for affected users. There is no indication of confidentiality or availability impact beyond user account deletion. No known exploits in the wild have been reported.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, site administrators should monitor for updates from the plugin vendor and consider restricting access to the affected functionality if possible. No vendor advisory or patch links are currently provided.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-02-11T16:54:51.661Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 69a062b5b7ef31ef0b701612
Added to database: 2/26/2026, 3:11:49 PM
Last enriched: 4/9/2026, 11:27:54 AM
Last updated: 4/12/2026, 2:42:29 AM
Views: 136
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.