The vulnerability in the User Registration & Membership plugin arises from missing ownership validation on a user‑controlled attachment ID. Because the plugin accepts a 'profile-pic-url' parameter without checking that the referenced media belongs to the requester, an authenticated user can trigger the plugin to delete any media attachment on the site.

This flaw impacts every release of the plugin up to and including version 5.1.5 of the wpeverest WordPress User Registration & Membership plugin. Users with subscriber-level access or higher, as well as administrators, are potentially affected and can experience permanent loss of media attachments.

The CVSS score of 5.3 indicates moderate severity; EPSS is not available and the vulnerability is not listed in CISA KEV. Attackers need only be authenticated and possess subscriber or higher privileges; no remote code execution or core compromise is required. The primary consequence is the irreversible deletion of user media, compromising site content integrity and availability.