Unauthenticated User Account Deletion in User Registration & Membership WordPress Plugin

Executive Summary

This vulnerability is an unauthenticated limited user deletion flaw in the User Registration & Membership WordPress plugin before version 5.2.3. It allows attackers to delete recently-registered user accounts that are in a payment-pending state by exploiting a missing capability check in a membership payment action. The attack involves supplying a user identifier and forcing a Stripe API failure, which triggers an exception handler that deletes the targeted user.

Useful 0 Not Useful 0

Detection Guidance

Check if the User Registration & Membership WordPress plugin is installed and verify its version. If it is below 5.2.3, the vulnerability may exist. Inspect server logs for unusual user deletion requests or failed Stripe API calls associated with user accounts.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected plugin version, attackers could delete user accounts that have not yet completed payment. This could disrupt legitimate user registrations, cause data loss for pending users, and potentially affect business operations relying on user accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could potentially affect compliance with GDPR and HIPAA by allowing unauthorized deletion of user accounts. Under GDPR, users have the right to erasure, but unauthorized deletion by attackers may violate data integrity and accountability requirements. HIPAA requires protection of patient data, and unauthorized account deletion could disrupt access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update the User Registration & Membership plugin to version 5.2.3 or later immediately. If updating is not possible, disable the plugin temporarily until an update is applied. Review user accounts for unauthorized deletions and monitor for suspicious activity.

Useful 0 Not Useful 0