CVE-2025-2594
User Registration & Membership < 4.1.3 - Authentication Bypass
- State
- Published
- Severity
- 8.1 High
- Published
- Apr 22, 2025
- Updated
- Aug 27, 2025
- Reserved
- Mar 21, 2025
Description
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 8.1 High | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
User Registration & MembershipUnknown |
|
References
- https://wpscan.com/vulnerability/1c1be47a-d5c0-4ac1-b9fd-475b382a7d8f/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.