CVE-2026-79995: User Registration WordPress Auth Bypass Flaw

CVE-2026-79995 Overview

CVE-2026-79995 is an Insecure Direct Object Reference (IDOR) vulnerability in the User Registration & Membership WordPress plugin prior to version 5.2.5. The plugin fails to verify that the account whose pending email change is being cancelled belongs to the user submitting the request. Authenticated users with Subscriber-level access or higher can cancel any other user's in-progress email change, including an administrator's. The flaw is tracked under CWE-639: Authorization Bypass Through User-Controlled Key.

Critical Impact
Any authenticated Subscriber can disrupt account maintenance workflows for other users, including administrators, by cancelling their pending email changes.

Affected Products

User Registration & Membership WordPress plugin versions prior to 5.2.5
WordPress sites using the plugin for membership and user management
Any deployment permitting open Subscriber-level registration

Discovery Timeline

2026-08-28 - CVE-2026-79995 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-79995

Vulnerability Analysis

The User Registration & Membership plugin exposes an authenticated endpoint that cancels a pending email change on a user account. The endpoint accepts a user identifier or request token but does not compare it against the current session's user ID. Any logged-in account can therefore submit the cancellation action against another user's pending email update.

An attacker with a Subscriber account, the lowest privileged authenticated role in WordPress, can enumerate targets and cancel administrator email changes. The vulnerability does not disclose data or allow account takeover directly. It does, however, break trust in account maintenance flows and can be chained with social engineering to keep an administrator anchored to a compromised mailbox.

Root Cause

The root cause is a missing ownership check on the request handler responsible for cancelling pending email changes. The plugin authenticates the requester but does not authorize the action against the target account. This pattern maps directly to CWE-639, where access control depends on a user-controllable key rather than the session identity.

Attack Vector

Exploitation requires a valid authenticated session at Subscriber level or above. The attacker sends a crafted request to the cancellation endpoint referencing another user's identifier or pending-change token. The server processes the request without verifying that the token belongs to the requester, resulting in cancellation of the targeted user's pending email change. See the WPScan Vulnerability Report for advisory details.

Detection Methods for CVE-2026-79995

Indicators of Compromise

Unexpected cancellation events in the User Registration & Membership plugin logs where the acting user differs from the target user
Administrator or Editor accounts reporting that pending email changes silently disappeared
Repeated authenticated POST requests from Subscriber accounts to plugin AJAX or REST endpoints referencing other user IDs

Detection Strategies

Audit web server logs for authenticated requests to plugin endpoints that include a user_id or token parameter not matching the session owner
Correlate WordPress user meta changes for pending email fields against the acting user recorded in access logs
Alert on Subscriber-role accounts issuing requests to management endpoints normally used by administrators

Monitoring Recommendations

Enable verbose logging for the User Registration & Membership plugin and forward events to a centralized log platform
Monitor for spikes in cancelled email-change events across multiple accounts within a short time window
Track newly registered Subscriber accounts that immediately interact with account-management endpoints

How to Mitigate CVE-2026-79995

Immediate Actions Required

Update the User Registration & Membership plugin to version 5.2.5 or later on all WordPress sites
Review pending email-change activity for administrator and privileged accounts since the plugin was installed
Restrict open Subscriber registration where it is not required for site functionality

Patch Information

The vendor addressed the missing authorization check in version 5.2.5 of the User Registration & Membership plugin. The fix adds verification that the account associated with the pending email change matches the authenticated requester. Consult the WPScan Vulnerability Report for the authoritative advisory.

Workarounds

Temporarily disable the User Registration & Membership plugin until the update is applied
Disable public user registration under Settings > General in WordPress to remove the Subscriber attack surface
Use a web application firewall rule to block requests to the plugin's cancellation endpoint from non-administrator sessions

bash

# Configuration example: disable open registration via WP-CLI
wp option update users_can_register 0
wp plugin update user-registration --version=5.2.5