Vulnerability in Wpeverest User_registration_\&_membership
CVE-2025-2594
The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply us…
EPSS: 0.074 (93.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.1 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Wpeverest User_registration_\&_membership
- Unknown User Registration & Membership — versions 0
Public proof-of-concept exploits
References
- contact@wpscan.com (Exploit, technical-description, Third Party Advisory, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2025-2594?
- CVE-2025-2594 is a high-severity vulnerability in Wpeverest User_registration_\&_membership, classified under CWE-639 AUTHORIZATION BYPASS THROUGH USER-CONTROLLED KEY. CVSS score: 8.1/10. Published 2025-04-22.
- How severe is CVE-2025-2594?
- High severity. CVSS v3 base score is 8.1 out of 10.
- Is CVE-2025-2594 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.