User Registration and Membership WordPress Plugin Insecure Direct Object Reference Vulnerability Allowing Arbitrary Media Deletion

A vulnerability exists in the User Registration & Membership WordPress plugin, specifically in versions through 5.1.5. The issue is an Insecure Direct Object Reference (IDOR) that arises from a lack of ownership validation on user-controlled attachment IDs. This flaw enables authenticated attackers with subscriber-level access or higher to delete any media attachments, including those uploaded by administrators, without permission. The vulnerability is exploited by manipulating the 'profile-pic-url' parameter to remove specified media attachments.

Impact

Exploitation of this vulnerability allows for the unauthorized deletion of media attachments from any user, including administrators.

Reproduction

To reproduce this vulnerability, an authenticated user with subscriber-level access can send a request that includes the 'profile-pic-url' or 'profile_pic_url' parameter. This parameter can be used to specify the ID of a media attachment to be deleted. The absence of proper validation allows the attacker to delete attachments that may belong to other users.

Remediation

Users are advised to update the User Registration & Membership plugin to version 5.1.6 or later, where this vulnerability has been patched.