CVE-2026-7651

Name of the Vulnerable Software and Affected Versions User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder versions prior to 5.1.6

Description An Insecure Direct Object Reference exists due to missing ownership validation on a user-controlled attachment ID. This allows authenticated attackers with subscriber-level access or higher to store and permanently delete arbitrary media attachments uploaded by any other user, including administrators, because the plugin fails to verify if the referenced attachment belongs to the requesting user.

Recommendations Update the plugin to version 5.1.6 or later.