PT-2026-1552 · WordPress · Wp-Members Membership Plugin

Thinnawarth Mathuros · Published 2026-01-07 · Updated 2026-01-07 · CVE-2025-12648

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP-Members Membership Plugin for WordPress versions up to and including 3.5.4.4

Description The WP-Members Membership Plugin for WordPress stores user-uploaded files in predictable directories (wp-content/uploads/wpmembers/user files/<user id>/) without sufficient access controls. This allows unauthenticated attackers to directly access and download sensitive documents uploaded by site users by guessing or enumerating user ids and filenames. Basic directory listing protection (.htaccess with Options -Indexes) is insufficient to prevent access.

Recommendations Versions prior to 3.5.4.4 should be updated.

Fix

Files Accessible to External Parties

Weakness Enumeration

CWE-552

Related Identifiers

CVE-2025-12648

Affected Products

Wp-Members Membership Plugin

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-12648 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/9d0154fd-0cab-4445-a92e-c44ae9931479?source=cve · Note
• https://plugins.trac.wordpress.org/changeset/3427043/wp-members/trunk/includes/class-wp-members-forms.php · Note
• https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/admin/class-wp-members-admin-api.php#L707 · Note
• https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/class-wp-members-forms.php#L604 · Note
• https://t.me/CVEtracker/41561 · Telegram Post
• https://twitter.com/CVEnew/status/2008771285783113997 · Twitter Post