The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress contains an Insecure Direct Object Reference vulnerability (CWE-639) in the create_stripe_subscription() function. Because the plugin does not validate the member_id parameter supplied by the user, an attacker who is not authenticated can request that the function delete any user account that was registered through the plugin. This deletion removes the user’s data and credentials, potentially disrupting site functionality and allowing the attacker to compromise the reputation of the site’s user base.

WordPress installations that use the User Registration & Membership plugin version 4.2.1 or earlier are affected. The vulnerability exists in the membership component of the plugin, and any site that has installed or activated this plugin version is at risk.

The vulnerability has a CVSS score of 5.3, indicating moderate severity, and the EPSS score is reported as less than 1 %, implying a low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The attack vector is inferred to be an unauthenticated HTTP request to the plugin’s AJAX endpoint, where the attacker provides a crafted member_id value. Since the function accepts the parameter without checks, the deletion proceeds without authentication.