CVE-2026-2356: WordPress User Registration IDOR Vulnerability

CVE-2026-2356 Overview

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference (IDOR) in all versions up to, and including, 5.1.2 via the register_member function. The vulnerability exists due to missing validation on the member_id user-controlled key, which allows unauthenticated attackers to delete arbitrary user accounts that have newly registered on the site and have the urm_user_just_created user meta set.

Critical Impact

Unauthenticated attackers can delete newly registered user accounts by manipulating the member_id parameter, potentially disrupting user registration workflows and denying service to legitimate users.

Affected Products

• User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress versions up to and including 5.1.2
• WordPress sites utilizing the membership registration functionality
• Sites with active user registration processes

Discovery Timeline

• 2026-02-26 - CVE CVE-2026-2356 published to NVD
• 2026-02-26 - Last updated in NVD database

Technical Details for CVE-2026-2356

Vulnerability Analysis

This Insecure Direct Object Reference vulnerability occurs within the membership module's AJAX handling functionality. The register_member function fails to properly validate ownership or authorization when processing the member_id parameter. This allows attackers to reference and manipulate user accounts they should not have access to.

The vulnerability specifically targets newly registered users who have the urm_user_just_created user meta value set. This metadata is typically assigned temporarily during the registration process, creating a window of opportunity for exploitation. By submitting crafted requests with arbitrary member_id values, an unauthenticated attacker can trigger the deletion of accounts matching this criteria.

The CWE-284 (Improper Access Control) classification reflects the fundamental failure to implement proper authorization checks before performing sensitive operations on user data.

Root Cause

The root cause lies in the absence of proper authorization validation within the register_member function located in the AJAX module. The function accepts a user-controlled member_id parameter and performs operations without verifying that the requesting user has legitimate access to modify or delete the referenced account. This classic IDOR pattern allows horizontal access to other users' resources through simple parameter manipulation.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending crafted HTTP requests to the WordPress AJAX endpoint with manipulated member_id values. The attack targets the registration workflow, specifically exploiting the timing window when new users have the urm_user_just_created meta flag set.

The exploitation flow involves:

1. Identifying the AJAX endpoint handling membership registration
2. Enumerating or guessing valid member_id values
3. Submitting requests with targeted member_id parameters to delete newly registered accounts

For technical implementation details, refer to the WordPress AJAX Module Code showing the vulnerable function implementation.

Detection Methods for CVE-2026-2356

Indicators of Compromise

• Unexpected user account deletions, particularly affecting newly registered users
• Unusual volume of AJAX requests to the user registration membership endpoints
• Log entries showing requests with varying member_id parameters from single IP addresses
• Reports from users unable to complete registration or finding their accounts deleted

Detection Strategies

• Monitor WordPress AJAX requests for suspicious patterns targeting the register_member action
• Implement rate limiting on registration-related AJAX endpoints
• Log and alert on multiple requests with different member_id values from the same source
• Track user account deletion events and correlate with registration timestamps

Monitoring Recommendations

• Enable detailed WordPress access logging to capture AJAX request parameters
• Set up alerts for anomalous user deletion activity during registration workflows
• Monitor for enumeration patterns in member_id parameter values
• Review web application firewall logs for IDOR attack patterns targeting user registration

How to Mitigate CVE-2026-2356

Immediate Actions Required

• Update the User Registration & Membership plugin to a version newer than 5.1.2 once a patched version is available
• Temporarily disable new user registration if the site is under active attack
• Implement additional access controls at the web server or WAF level to restrict AJAX endpoint access
• Review and restore any user accounts that may have been deleted during potential exploitation

Patch Information

A patched version addressing this vulnerability should be obtained from the official WordPress plugin repository. The fix will implement proper authorization checks on the member_id parameter within the register_member function to ensure users can only perform operations on their own accounts. Refer to the Wordfence Vulnerability Report for additional details and patch status updates.

Workarounds

• Implement a Web Application Firewall (WAF) rule to validate and restrict member_id parameter manipulation
• Add server-side access controls to require authentication for membership AJAX endpoints
• Use security plugins like Wordfence to monitor and block suspicious IDOR attack patterns
• Consider temporarily disabling the membership registration feature until the patch is applied

# Example: Add .htaccess rules to restrict direct AJAX access (Apache)
# Place in WordPress root directory

<IfModule mod_rewrite.c>
RewriteEngine On
# Block direct access to membership AJAX endpoints from external sources
RewriteCond %{REQUEST_METHOD} POST
RewriteCond %{REQUEST_URI} admin-ajax\.php
RewriteCond %{HTTP_REFERER} !^https?://(www\.)?yourdomain\.com [NC]
RewriteRule .* - [F,L]
</IfModule>