CVE-2025-2563
HIGH
Published 2025-04-14T06:00:09.509Z
Actions:
CVSS Score
V3.1
8.1
/10
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score Metrics
Exploitability: N/A
Impact: N/A
Attack Vector Metrics
Impact Metrics
Description
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
Available Exploits
User Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation
The User Registration & Membership plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 4.1.1. This is due to insufficient restrictions on role type in the 'prepare_members_data()' function. This makes it possible for unauthenticated attackers to create newuser accounts with the 'administrator' role, allowing complete control over the affected WordPress site.
ID: CVE-2025-2563
Author: iamnoooobrootxharshpdresearch
Critical
References:
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/user-registration/user-registration-membership-411-unauthenticated-privilege-escalation
- https://patchstack.com/database/wordpress/plugin/user-registration/vulnerability/wordpress-user-registration-membership-plugin-4-1-2-unauthenticated-privilege-escalation-vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2025-2563
Related News
No news articles found for this CVE.
Affected Products
Affected Versions:
Published: 2025-04-14T06:00:09.509Z
Last Modified: 2025-04-14T14:20:32.047Z
Copied to clipboard!