PT-2025-16167 · WordPress · User Registration & Membership

Wesley · Published 2025-04-12 · Updated 2025-07-08 · CVE-2025-3282

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions: User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress versions up to, and including, 4.1.3

Description: The issue allows unauthenticated attackers to update any user's membership to any other active or non-active membership type due to missing validation on the membership id user-controlled key in the user registration membership register member() function. This is a result of Insecure Direct Object Reference.

Recommendations: For versions up to, and including, 4.1.3, consider disabling the user registration membership register member() function until a patch is available to prevent exploitation. Restrict access to the membership id key to minimize the risk of unauthorized membership updates.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-3282

Affected Products

User Registration & Membership

References · 10

• https://plugins.trac.wordpress.org/changeset/3268617/user-registration/trunk/modules/membership/includes/AJAX.php · Patch
• https://osv.dev/vulnerability/CVE-2025-3282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-3282 · Security Note
• https://t.me/cvenotify/128053 · Telegram Post
• https://t.me/cvedetector/22793 · Telegram Post
• https://t.me/cvenotify/118979 · Telegram Post
• https://t.me/cvetracker/21468 · Telegram Post
• https://twitter.com/cybercronai/status/1911143625267855452 · Twitter Post
• https://twitter.com/CVEnew/status/1910949784761872468 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c525b41c-dca5-442a-927e-4583cb303ed1?source=cve · Note