PT-2026-1552 · WordPress · Wp-Members Membership Plugin

Thinnawarth Mathuros · Publicado 2026-01-07 · Atualizado 2026-01-07 · CVE-2025-12648

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP-Members Membership Plugin for WordPress versions up to and including 3.5.4.4

Description The WP-Members Membership Plugin for WordPress stores user-uploaded files in predictable directories (wp-content/uploads/wpmembers/user files/<user id>/) without sufficient access controls. This allows unauthenticated attackers to directly access and download sensitive documents uploaded by site users by guessing or enumerating user ids and filenames. Basic directory listing protection (.htaccess with Options -Indexes) is insufficient to prevent access.

Recommendations Versions prior to 3.5.4.4 should be updated.

Correção

Files Accessible to External Parties

Enumeração de Fraquezas

CWE-552

Identificadores relacionados

CVE-2025-12648

Produtos afetados

Wp-Members Membership Plugin

Referências · 7

• https://wordfence.com/threat-intel/vulnerabilities/id/9d0154fd-0cab-4445-a92e-c44ae9931479?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3427043/wp-members/trunk/includes/class-wp-members-forms.php · Nota
• https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/admin/class-wp-members-admin-api.php#L707 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-12648 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/class-wp-members-forms.php#L604 · Nota
• https://t.me/CVEtracker/41561 · Publicação no Telegram
• https://twitter.com/CVEnew/status/2008771285783113997 · Publicação no Twitter