User Registration Membership
CVE-2025-2563
HIGH
Vulnerability Assessment
| Impact | CVSS 8.1, EPSS 83.9%, PoC available. The User Registration plugin is popular for sites requiring membership functionality, including e-commerce, learning platforms, and community sites. The attack is trivially exploitable via browser developer tools or a single curl command. |
| Exploit ScenarioDerived | An attacker visits a WordPress site's registration page, intercepts the form submission, adds or modifies the role parameter to 'administrator', and submits. The plugin creates an admin account. The attacker logs in with full privileges, installs a persistent backdoor, and begins accessing restricted content and user data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Mar 28, 2026
The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their account role when the Membership Addon is enabled. This allows unauthenticated users to register with administrator privileges, bypassing all intended access controls.
Earlier versions of this analysis (1)
Privilege escalation in User Registration & Membership WordPress plugin allows unauthenticated admin registration when Membership Addon is active.
RemediationAI
Update to version 4.1.2 or later. Audit the WordPress users table for recently created accounts with administrator role. If unauthorized admins are found, delete them and change all admin passwords. Review registration form for proper role enforcement.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The plugin's registration form processing does not properly validate the user role parameter when the Membership Addon is enabled. An attacker can manipulate the registration request to set their role to 'administrator' instead of the intended default role. The server-side validation fails to restrict role assignment, allowing the elevated account creation.
Know when User Registration Membership gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
Executive ViewAI
Organizations using Membership WordPress face notable risk from CVE-2025-2563 rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems. With an EPSS score of 84%, this vulnerability faces very high likelihood of exploitation. Organizations should apply vendor updates when available and consider compensating controls in the interim.
Apply vendor patch. If immediate patching is not feasible: (1) Implement network-level access controls to limit exposure; (2) Enable enhanced monitoring and alerting; (3) Apply principle of least privilege.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Affected Products (CPE)CVE.org
More in User Registration Membership
View allThe User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when
Payment-verification bypass in the User Registration & Membership WordPress plugin before 5.2.2 lets unauthenticated att
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.3 lets unauthenticated visitors s
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.2 lets any authenticated low-priv
Privilege escalation in the User Registration & Membership WordPress plugin (versions 4.4.6 through pre-5.2.8) allows an
Registration enforcement bypass in the User Registration & Membership WordPress plugin (all versions before 5.2.6) allow
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.8 allows any authenticated user h
Privilege escalation in the User Registration & Membership WordPress plugin before 5.2.6 lets authenticated users holdin
Unauthenticated account deletion in the User Registration & Membership WordPress plugin (all versions before 5.2.3) expo
Open redirect in the User Registration & Membership WordPress plugin before 5.2.8 permits unauthenticated attackers to c
Missing object-level authorization in the User Registration & Membership WordPress plugin (before 5.2.5) allows any auth
Unauthenticated information disclosure in the User Registration & Membership WordPress plugin (versions 5.0 through 5.2.
GitHub PoC
Exploit-DB