Email Change Cancellation in User Registration & Membership WordPress Plugin

Executive Summary

This is an Insecure Direct Object Reference (IDOR) vulnerability in the WordPress plugin User Registration & Membership before version 5.2.5. It allows authenticated users with Subscriber-level access or higher to cancel pending email change requests for any other user, including administrators, without proper verification.

Useful 0 Not Useful 0

Detection Guidance

Check if your WordPress site uses the User Registration & Membership plugin version prior to 5.2.5. Log in as a Subscriber-level user and attempt to cancel an email change request for another user, including an administrator. If successful, the site is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could prevent legitimate users, including administrators, from receiving important email communications by cancelling their pending email changes. This could disrupt account management and lead to loss of access or control over accounts.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by potentially preventing users from receiving critical communications, such as password reset emails or account notifications, which may violate data protection requirements for timely access and communication.

Useful 0 Not Useful 0

Mitigation Strategies

Update the User Registration & Membership plugin to version 5.2.5 or later immediately. If updating is not possible, consider disabling the plugin until the update is applied.

Useful 0 Not Useful 0