CVE-2025-2563

8.1 HIGH 49% exploit odds No fix listed Auth & access Web app

What it is

The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges

At a glance

Exploitability: Can be exploited over the network without logging in. High risk of data exposure, data tampering, service disruption.
Exploit odds: 49.1% chance of exploitation in the next 30 days (EPSS). Higher than most.
Fix: No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

2025-04-14 06:15 UTC PublishedDisclosed publicly on CVE.org and NVD
2026-06-17 09:07 UTC Last updatedMost recent change to the record

Details

Published: 2025-04-14 06:15 UTC
Last modified: 2026-06-17 09:07 UTC
Exploit probability: 49.1% · EPSS, next 30 days
Record status: Analyzed

Affected

Wpeverest User Registration \& Membership < 4.1.2
Wpeverest User Registration \& Membership < 5.1.2

Attack profile CVSS 3.1 · 8.1

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Raw vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Download Square Reddit

References

https://wpscan.com/vulnerability/2c0f62a1-9510-4f90-a297-17634e6c8b75/

NVD record · CVE.org record