VULNERABILITY INTELLIGENCE

CVE-2025-2594

CVSS score8.1 HIGH
EPSS probability9.52%
CISA KEVNot currently listed
Published2025-04-22
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Description

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.

Weakness classification

  • nvd@nist.gov: NVD-CWE-noinfo

Primary references