CVE-2025-2594

User Registration & Membership < 4.1.3 - Authentication Bypass

High · published April 22, 2025

CVSS v3.1
8.1
EPSS
10%
Percentile
95.4
In the wild
Unconfirmed
What it is

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.09524 · 95.4th percentile
Published
2025-04-22T06:00Z
EPSS history
Timeline
  • 22 APR 06:00Z
    User Registration & Membership < 4.1.3 - Authentication Bypass
    cvelistv5