User Registration & Membership < 5.2.5 - Subscriber+ Pending Email Change Cancellation via IDOR

Description

The plugin does not verify that the account whose pending email change is being cancelled belongs to the user making the request, allowing authenticated users with Subscriber-level access and above to cancel any other user's in-progress email change, including an administrator's.