CVE-2025-2594

PoC —

CVSS 3.1

8.1 high

EPSS

9%p95

Published

Apr 22, 2025 (Apr 22, 2025)

Modified

Jun 17, 2026

Description

The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target account's user ID.

Vendors: wpeverest
Products: user registration \& membership
Ecosystems: WordPress
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (9.1%)

In the news0 stories

No ingested article mentions this CVE yet.