What is CVE-2025-12648?

CVE-2025-12648 is a medium-severity vulnerability in Cbutlerjr Wp-Members Membership Plugin, classified under Files or Directories Accessible to External Parties. CVSS score: 5.3/10. Published 2026-01-07.

How severe is CVE-2025-12648?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Cbutlerjr Wp-Members Membership Plugin

CVE-2025-12648

The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user-uploaded files in predictable directories (wp-content/uploads/wpmembers/user_files/<user_id>/) without implementing proper access controls beyond basic directory listing protection (.htaccess with Options -Indexes). This makes it possible for unauthenticated attackers to directly access and download sensitive documents uploaded by site users via direct URL access, granted they can guess or enumerate user IDs and filenames.

EPSS: 0.003 (17.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Affected products

Cbutlerjr Wp-members Membership Plugin — versions 0

Weakness classification (CWE)

CWE-552 — Files or Directories Accessible to External Parties

References

Frequently asked questions

What is CVE-2025-12648?: CVE-2025-12648 is a medium-severity vulnerability in Cbutlerjr Wp-Members Membership Plugin, classified under Files or Directories Accessible to External Parties. CVSS score: 5.3/10. Published 2026-01-07.
How severe is CVE-2025-12648?: Medium severity. CVSS v3 base score is 5.3 out of 10.