CVE-2026-2356

{"id": "CVE-2026-2356", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "security@wordfence.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "published": "2026-02-26T03:16:05.293", "references": [{"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/5.1.1/modules/membership/includes/AJAX.php#L142", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a5a1ccb2-4f78-4855-a01d-b15f73407822?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Primary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-284"}]}], "descriptions": [{"lang": "en", "value": "The User Registration & Membership \u2013 Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.1.2 via the 'register_member' function, due to missing validation on the 'member_id' user controlled key. This makes it possible for unauthenticated attackers to delete arbitrary user accounts that newly registered on the site who has the 'urm_user_just_created' user meta set."}, {"lang": "es", "value": "El plugin User Registration & Membership \u2013 Custom Registration Form, Login Form, and User Profile para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 5.1.2, inclusive, a trav\u00e9s de la funci\u00f3n 'register_member', debido a la falta de validaci\u00f3n en la clave 'member_id' controlada por el usuario. Esto hace posible que atacantes no autenticados eliminen cuentas de usuario arbitrarias que se registraron recientemente en el sitio y que tienen configurado el metadato de usuario 'urm_user_just_created'."}], "lastModified": "2026-02-27T14:06:59.787", "sourceIdentifier": "security@wordfence.com"}