CVE-2026-79995
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The User Registration & Membership WordPress plugin before version 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request. Authenticated users with Subscriber-level access and above can cancel any other user's in-progress email change, including an administrator's.
Risk Assessment
This could disrupt the email change process for administrators, potentially enabling social engineering attacks or account destabilization.
Recommendation
Update the User Registration & Membership plugin to version 5.2.5 or later, which includes the ownership verification fix.
Other vulnerabilities in User Registration & Membership WordPress plugin
See all- CVE-2026-79996High
The User Registration & Membership WordPress plugin before version 5.2.6 does not perform a capability check when saving its login settings. Authenticated users with plugin management capability but without full administrator access can change arbitrary site options and escalate their privileges to administrator.
- CVE-2026-16736High
The User Registration & Membership WordPress plugin before 5.2.6 does not enforce the site's registration-disabled setting when processing registration-form submissions, allowing unauthenticated users to create new accounts even when the administrator has turned off open registration.
Original NVD description (English source)
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.