The User Registration & Membership WordPress plugin versions prior to 5.2.3 lacks a capability check for unauthenticated callers on a Stripe subscription handler that is used for membership payments. As a result, any external actor can supply a user identifier in an HTTP request and trigger the deletion of a user account that has just been registered and is pending payment. The flaw allows the attacker to permanently remove those accounts, interrupting normal registration flow and potentially causing lost revenue or data loss.

WordPress sites that include the User Registration & Membership plugin before v5.2.3 are affected. No other vendors or product versions are listed, and the plugin name and version range are the only identifying details.

The CVSS score of 5.3 indicates moderate severity, and the EPSS score of less than 1% points to a very low but nonzero exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an unauthenticated HTTP request to the plugin’s Stripe subscription handler endpoint, where the attacker supplies a user identifier to the service. Successful exploitation does not require privileged access or user enumeration beyond knowing existing user IDs.