CVE-2026-79995: unknown user registration & membership
Vulnerability summary
CVE-2026-79995 is a medium (CVSS 4.3) vulnerability in unknown user registration & membership. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15.8% of scored vulnerabilities. 1 public exploit is recorded. Fixed in 5.2.5.
Timeline
- 28-08-2026PublishedVulnerability first disclosed.
- 28-08-2026Last modifiedVulnerability information updated.
Description
The User Registration & Membership WordPress plugin before 5.2.5 does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.
CVSS metrics
3 scores · 3 sources · 1 version- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- wordfenceSource4.3MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
16%
Versus all other CVEs
30-day change
+0.07 pp
From 0.18% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
Wordpress1 product
- user-registration< 5.2.5
2 vendors · 2 products