The User Registration & Membership plugin for WordPress is affected by an Insecure Direct Object Reference flaw in the register_member function. The member_id parameter is not subject to any server‑side validation, allowing any user to supply the identifier of a new account that still carries the special 'urm_user_just_created' meta field and have that account removed. The vulnerability does not expose user credentials or sensitive data, but it does enable an attacker to silently delete user accounts, potentially disrupting service, losing content, and forcing legitimate users to re‑register.

All WordPress installations running the wpeverest User Registration & Membership plugin version 5.1.2 or earlier are vulnerable. The affected component is the plugin’s register_member AJAX handler, which is exposed to unauthenticated web traffic.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote HTTP request that invokes the register_member AJAX endpoint with a crafted member_id value. An attacker does not need authentication, making exploitation simple but limited to accounts that still possess the 'urm_user_just_created' meta tag.