PT-2025-9164 · WordPress · Setsail Membership

Tonn · Published 2025-03-01 · Updated 2025-03-07 · CVE-2025-1564

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SetSail Membership plugin for WordPress versions up to, and including, 1.0.3

Description The issue arises from the plugin's failure to properly verify a user's identity through social login, allowing unauthenticated attackers to log in as any user, including administrators, and take over access to their account.

Recommendations For versions up to, and including, 1.0.3, update to a version higher than 1.0.3 to resolve the issue. As a temporary workaround, consider disabling the social login feature until a patch is available. Restrict access to sensitive areas of the WordPress dashboard to minimize the risk of exploitation.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-1564

Affected Products

Setsail Membership

References · 13

• https://nvd.nist.gov/vuln/detail/CVE-2025-1564 · Security Note
• https://themeforest.net/item/setsail-travel-agency-theme/22832625 · Note
• https://twitter.com/cracbot/status/1897603147083943995 · Twitter Post
• https://t.me/cvenotify/112977 · Telegram Post
• https://t.me/latest_high_impact_cve/1891 · Telegram Post
• https://twitter.com/CveFindCom/status/1895761579708125317 · Twitter Post
• https://t.me/cvedetector/19217 · Telegram Post
• https://twitter.com/CVEnew/status/1895981992682062027 · Twitter Post
• https://twitter.com/cybercronai/status/1896104517600477688 · Twitter Post
• https://twitter.com/vulns_space/status/1895757875324022854 · Twitter Post
• https://twitter.com/vFeed_IO/status/1897832549927600430 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/c2c2385e-0d1e-435a-9b82-972964084148?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1895759311155966289 · Twitter Post