PT-2025-17351 · WordPress · Urbango Membership

Alyudin Nafiie · Published 2025-04-19 · Updated 2025-04-22 · CVE-2025-3278

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions UrbanGo Membership plugin for WordPress versions up to, and including, 1.0.4

Description The issue is related to privilege escalation due to the plugin allowing users who are registering new accounts to set their own role or by supplying the user register role field. This makes it possible for unauthenticated attackers to gain elevated privileges by creating an account with the administrator role.

Recommendations For versions up to, and including, 1.0.4, consider disabling the user registration feature or restricting the user register role field to prevent unauthenticated attackers from gaining elevated privileges until a patch is available.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-3278

Affected Products

Urbango Membership

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-3278 · Security Note
• https://t.me/cvedetector/23369 · Telegram Post
• https://twitter.com/CveFindCom/status/1914584368858771789 · Twitter Post
• https://twitter.com/vulns_space/status/1913446258280169642 · Twitter Post
• https://twitter.com/cybercronai/status/1913797499665461546 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/913ffe0c-c8f8-4cda-be9a-96c056d4c4a8?source=cve · Note
• https://twitter.com/cybercronai/status/1913650151341564046 · Twitter Post
• https://t.me/latest_high_impact_cve/2163 · Telegram Post
• https://themeforest.net/item/urbango-directory-and-listing-wordpress-theme/22712624 · Note
• https://twitter.com/CVEnew/status/1913455453331132868 · Twitter Post
• https://t.me/cvetracker/21967 · Telegram Post