VULNERABILITY INTELLIGENCE

CVE-2026-79995

CVSS score4.3 MEDIUM
EPSS probability0.25%
CISA KEVNot currently listed
Published2026-08-28
Last modified2026-08-28
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Description

The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.

Weakness classification

  • CWE-639: Authorization Bypass Through User-Controlled Key

Primary references