Vulnerability · Published Apr 22, 2025 · Assigned by WPScan
CVE-2025-2594User Registration & Membership < 4.1.3 - Authentication Bypass
High 8.1
In plain English
A high-severity security flaw in User Registration & Membership from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 9.5% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)9.5%top 4.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | User Registration & Membership | 0 – before 4.1.3 |
References
- https://wpscan.com/vulnerability/1c1be47a-d5c0-4ac1-b9fd-475b382a7d8f/ exploit, vdb-entry, technical-description