PT-2025-19903 · WordPress · User Registration & Membership

Wesley + 1 · Published 2025-05-06 · Updated 2025-10-05 · CVE-2025-3281

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress versions prior to 4.2.2

Description The issue is related to an Insecure Direct Object Reference in the create stripe subscription() function, due to missing validation on the member id user-controlled key. This allows unauthenticated attackers to delete arbitrary user accounts registered through the plugin.

Recommendations For versions prior to 4.2.2, update to version 4.2.2 or later to resolve the issue. As a temporary workaround, consider disabling the create stripe subscription() function until a patch is available.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-3281

Affected Products

User Registration & Membership

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-3281 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/30339ff6-b6bf-4c56-b6cd-db0b8a6ce8b6?source=cve · Note
• https://twitter.com/CVEnew/status/1919661051127464309 · Twitter Post
• https://twitter.com/hijak01/status/1974627693313597910 · Twitter Post
• https://plugins.trac.wordpress.org/browser/user-registration/tags/4.1.3/modules/membership/includes/AJAX.php#L619 · Note
• https://plugins.trac.wordpress.org/changeset/3287698/user-registration/trunk/modules/membership/includes/AJAX.php · Note
• https://t.me/cvenotify/120943 · Telegram Post