CVE-2026-11966 — User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler

CVE-2026-11966

User Registration & Membership < 5.2.3 - Unauthenticated Limited User Deletion via Stripe Subscription Handler PUBLISHED

Description (CNA)

The User Registration & Membership WordPress plugin before 5.2.3 does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.

Affected (CNA)

Vendor / product	Versions
Unknown / User Registration & Membership	affected 4.2.3 before 5.2.3

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/8e3be064-b3b7-4d68-960b-8c850c3e6f77/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.