User Registration and Membership WordPress Plugin Insecure Direct Object Reference Vulnerability Allowing Unauthenticated User Deletion

A vulnerability allowing Insecure Direct Object Reference (IDOR) has been identified in the User Registration & Membership WordPress plugin, specifically in versions through 4.2.1. The issue arises in the create_stripe_subscription() function, where there is a lack of proper validation on the 'member_id' key, which is controlled by users. This vulnerability enables unauthenticated attackers to delete any user accounts that registered using this plugin.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of user accounts that registered through the affected WordPress plugin.

Reproduction

To reproduce this vulnerability, send a request to the WordPress site's admin-ajax.php file, targeting the 'create_stripe_subscription' action. Include a 'member_id' parameter with the ID of the user account to be deleted. The request can be made without authentication, exploiting the missing validation on the 'member_id' parameter.

Remediation

Users are advised to update the User Registration & Membership plugin to version 4.2.2 or later.