The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled… (CVE-2026-79995)

The vulnerability in the User Registration & Membership WordPress plugin prior to version 5.2.5 arises from insufficient verification during the cancellation of pending email changes. Specifically, the plugin fails to confirm that the account associated with the pending email change belongs to the user making the cancellation request. Consequently, any authenticated user with Subscriber-level privileges or above can cancel the email change process for other users, potentially disrupting account management workflows.

Authenticated users with Subscriber-level access or higher can cancel pending email changes for any user, including administrators. This could interfere with legitimate email update processes but does not directly allow account takeover or privilege escalation based on the provided information.

Upgrade the User Registration & Membership WordPress plugin to version 5.2.5 or later, where this verification issue has been addressed. No other mitigation guidance is provided. Patch status is not explicitly confirmed in the input data, but the version boundary indicates a fix in 5.2.5.