Vulnerability in Wpeverest User_registration_\&_membership
CVE-2025-2563
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain adm…
EPSS: 0.464 (98.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Wpeverest User_registration_\&_membership
- Unknown User Registration & Membership — versions 0
Public proof-of-concept exploits
References
- contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2025-2563?
- CVE-2025-2563 is a high-severity vulnerability in Wpeverest User_registration_\&_membership, classified under CWE-639 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY. CVSS score: 8.1/10. Published 2025-04-14.
- How severe is CVE-2025-2563?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2025-2563 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.