CVE-2026-2356: WordPress User Registration IDOR Vulnerability

CVE-2026-2356 Overview

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to, and including, 5.1.2 via the register_member function. The vulnerability exists due to missing validation on the member_id user-controlled key, which allows unauthenticated attackers to delete arbitrary user accounts that have newly registered on the site and have the urm_user_just_created user meta set.

Critical Impact
Unauthenticated attackers can delete newly registered user accounts by manipulating the member_id parameter, potentially disrupting user registration workflows and denying service to legitimate users.

Affected Products

User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress versions up to and including 5.1.2
WordPress sites utilizing the membership registration functionality
Sites with active user registration processes

Discovery Timeline

2026-02-26 - CVE CVE-2026-2356 published to NVD
2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-2356

Vulnerability Analysis

This Insecure Direct Object Reference vulnerability occurs within the membership module's AJAX handling functionality. The register_member function fails to properly validate ownership or authorization when processing the member_id parameter. This allows attackers to reference and manipulate user accounts they should not have access to.

The vulnerability specifically targets newly registered users who have the urm_user_just_created user meta value set. This metadata is typically assigned temporarily during the registration process, creating a window of opportunity for exploitation. By submitting crafted requests with arbitrary member_id values, an unauthenticated attacker can trigger the deletion of accounts matching this criteria.

The CWE-284 (Improper Access Control) classification reflects the fundamental failure to implement proper authorization checks before performing sensitive operations on user data.

Root Cause

The root cause lies in the absence of proper authorization validation within the register_member function located in the AJAX module. The function accepts a user-controlled member_id parameter and performs operations without verifying that the requesting user has legitimate access to modify or delete the referenced account. This classic IDOR pattern allows horizontal access to other users' resources through simple parameter manipulation.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP requests to the WordPress AJAX endpoint with manipulated member_id values. The attack targets the registration workflow, specifically exploiting the timing window when new users have the urm_user_just_created meta flag set.

The exploitation flow involves:

Identifying the AJAX endpoint handling membership registration
Enumerating or guessing valid member_id values
Submitting requests with targeted member_id parameters to delete newly registered accounts

For technical implementation details, refer to the WordPress AJAX Module Code showing the vulnerable function implementation.

Detection Methods for CVE-2026-2356

Indicators of Compromise

Unexpected user account deletions, particularly affecting newly registered users
Unusual volume of AJAX requests to the user registration membership endpoints
Log entries showing requests with varying member_id parameters from single IP addresses
Reports from users unable to complete registration or finding their accounts deleted

Detection Strategies

Monitor WordPress AJAX requests for suspicious patterns targeting the register_member action
Implement rate limiting on registration-related AJAX endpoints
Log and alert on multiple requests with different member_id values from the same source
Track user account deletion events and correlate with registration timestamps

Monitoring Recommendations

Enable detailed WordPress access logging to capture AJAX request parameters
Set up alerts for anomalous user deletion activity during registration workflows
Monitor for enumeration patterns in member_id parameter values
Review web application firewall logs for IDOR attack patterns targeting user registration

How to Mitigate CVE-2026-2356

Immediate Actions Required

Update the User Registration & Membership plugin to a version newer than 5.1.2 once a patched version is available
Temporarily disable new user registration if the site is under active attack
Implement additional access controls at the web server or WAF level to restrict AJAX endpoint access
Review and restore any user accounts that may have been deleted during potential exploitation

Patch Information

A patched version addressing this vulnerability should be obtained from the official WordPress plugin repository. The fix will implement proper authorization checks on the member_id parameter within the register_member function to ensure users can only perform operations on their own accounts. Refer to the Wordfence Vulnerability Report for additional details and patch status updates.

Workarounds

Implement a Web Application Firewall (WAF) rule to validate and restrict member_id parameter manipulation
Add server-side access controls to require authentication for membership AJAX endpoints
Use security plugins like Wordfence to monitor and block suspicious IDOR attack patterns
Consider temporarily disabling the membership registration feature until the patch is applied

bash

# Example: Add .htaccess rules to restrict direct AJAX access (Apache)
# Place in WordPress root directory

<IfModule mod_rewrite.c>
RewriteEngine On
# Block direct access to membership AJAX endpoints from external sources
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} admin-ajax\.php
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
RewriteRule .* - [F,L]
</IfModule>