PT-2025-17488 · WordPress · User Registration & Membership

Wesley · Published 2025-04-22 · Updated 2025-08-27 · CVE-2025-2594

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions User Registration & Membership WordPress plugin version 4.1.2 and earlier

Description The issue concerns the User Registration & Membership WordPress plugin, where data in an AJAX action is not properly validated when the Membership Addon is enabled. This allows attackers to authenticate as any user, including administrators, by simply using the target account's user id.

Recommendations For versions prior to 4.1.3, update to version 4.1.3 or later to resolve the issue. As a temporary workaround, consider disabling the Membership Addon until the update is applied. Restrict access to the AJAX action to minimize the risk of exploitation. Avoid using the user id in the affected AJAX action until the issue is resolved.

Exploit

Fix

Related Identifiers

CVE-2025-2594

Affected Products

User Registration & Membership

References · 9

• 🔥 https://wpscan.com/vulnerability/1c1be47a-d5c0-4ac1-b9fd-475b382a7d8f · Exploit
• https://osv.dev/vulnerability/CVE-2025-2594 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-2594 · Security Note
• https://t.me/cvedetector/23487 · Telegram Post
• https://t.me/cvenotify/121286 · Telegram Post
• https://t.me/cveNotify/133676 · Telegram Post
• https://t.me/cvetracker/22094 · Telegram Post
• https://twitter.com/CVEnew/status/1914572071386145214 · Twitter Post
• https://t.me/cvenotify/119297 · Telegram Post