CVE-2026-11966 Overview
CVE-2026-11966 is a missing authorization vulnerability in the User Registration & Membership WordPress plugin versions before 5.2.3. The plugin fails to perform a capability check for unauthenticated callers on one of its membership payment actions. It also acts on a caller-supplied user identifier without validation. Unauthenticated attackers can exploit this flaw to delete recently-registered, payment-pending user accounts on affected sites. The vulnerability is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.
Critical Impact
Unauthenticated attackers can remotely delete payment-pending user accounts by supplying arbitrary user identifiers to an unprotected plugin action.
Affected Products
- User Registration & Membership WordPress plugin versions before 5.2.3
- WordPress sites using the plugin's membership payment workflow
- Sites with recently-registered, payment-pending user accounts
Discovery Timeline
- 2026-07-17 - CVE-2026-11966 published to NVD
- 2026-07-17 - Last updated in NVD database
Technical Details for CVE-2026-11966
Vulnerability Analysis
The flaw resides in one of the plugin's membership payment actions. The handler is exposed to unauthenticated callers and does not enforce a capability check. It accepts a user identifier supplied directly in the request and operates on that account without verifying the caller has permission.
An attacker sends a crafted HTTP request to the vulnerable action endpoint. The request specifies the ID of a target user account in a payment-pending state. The plugin processes the request and deletes the referenced account. This behavior maps to [CWE-639], where authorization decisions rely on an attacker-controllable value.
The impact is limited to user accounts still in the payment-pending state after registration. Attackers cannot delete established members or administrators through this path. However, the flaw disrupts the registration and monetization pipeline of affected membership sites.
Root Cause
The root cause is a combination of two defects. First, the payment action handler lacks a capability or nonce check for the caller. Second, the handler trusts a client-supplied user ID as the target of a destructive operation. Together these produce an Insecure Direct Object Reference on a deletion primitive.
Attack Vector
Exploitation occurs over the network with no authentication and no user interaction. An attacker enumerates or guesses recently-created pending user IDs and issues the destructive request. Detailed technical analysis is available in the WPScan Vulnerability Report.
Detection Methods for CVE-2026-11966
Indicators of Compromise
- Unauthenticated POST or GET requests to the plugin's membership payment action endpoints from unfamiliar IP addresses
- Unexpected deletions of pending user accounts shortly after registration events in WordPress logs
- Repeated requests iterating sequential user IDs against plugin AJAX or REST endpoints
- Support tickets from users reporting their in-progress registration disappeared before payment completion
Detection Strategies
- Monitor WordPress user_register and deleted_user action hooks and alert when a delete event occurs without a corresponding authenticated administrator session
- Inspect web server access logs for unauthenticated calls to the plugin's payment action endpoints with a user_id or equivalent parameter
- Correlate short intervals between account creation and account deletion for the same user ID as an anomaly signal
Monitoring Recommendations
- Enable WordPress audit logging to capture user lifecycle events with source IP and authentication context
- Forward web server and WordPress logs to a central analytics platform for baseline and anomaly detection
- Track error rates and 4xx responses on the plugin's action endpoints to identify enumeration attempts
How to Mitigate CVE-2026-11966
Immediate Actions Required
- Update the User Registration & Membership WordPress plugin to version 5.2.3 or later
- Audit existing user accounts to identify unexpected deletions of pending registrations
- Restrict access to WordPress AJAX and REST endpoints at the web application firewall until the patch is applied
Patch Information
Upgrade to User Registration & Membership version 5.2.3, which introduces a capability check on the affected membership payment action and validates the target user against the authenticated caller. Refer to the WPScan Vulnerability Report for version confirmation.
Workarounds
- Block unauthenticated requests to the vulnerable plugin action at the WAF or reverse proxy layer
- Temporarily disable the membership payment feature if the patch cannot be applied immediately
- Require authenticated sessions for all plugin AJAX endpoints via server-side access controls
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
