What is the CVSS score of CVE-2025-2563?

CVE-2025-2563 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 83.9%.

Which versions of User Registration Membership are affected by CVE-2025-2563?

Organizations using Membership WordPress face notable risk from CVE-2025-2563 rated CVSS 8.1.

Is there a public PoC exploit available for CVE-2025-2563?

Yes, a public proof-of-concept exploit is available for CVE-2025-2563. Prioritise patching immediately. EPSS: 83.9%.

How to fix or mitigate CVE-2025-2563?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

User Registration Membership CVE-2025-2563

HIGH

2025-04-14 contact@wpscan.com

WordPress Privilege Escalation User Registration Membership PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 28, 2026 - 18:36 vuln.today

PoC Detected

Apr 29, 2025 - 20:32 vuln.today

Public exploit code

CVE Published

Apr 14, 2025 - 06:15 nvd

HIGH 8.1

DescriptionCVE.org

The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges

AnalysisAI

The User Registration & Membership WordPress plugin before version 4.1.2 fails to prevent users from setting their account role when the Membership Addon is enabled. This allows unauthenticated users to register with administrator privileges, bypassing all intended access controls.

Technical ContextAI

The plugin's registration form processing does not properly validate the user role parameter when the Membership Addon is enabled. An attacker can manipulate the registration request to set their role to 'administrator' instead of the intended default role. The server-side validation fails to restrict role assignment, allowing the elevated account creation.

RemediationAI

Update to version 4.1.2 or later. Audit the WordPress users table for recently created accounts with administrator role. If unauthorized admins are found, delete them and change all admin passwords. Review registration form for proper role enforcement.