CoreCVE
Back

MEDIUM

User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification

Published Apr 12, 2025

Description

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type.

Affected products

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-639

Authorization Bypass

References (3)

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED
Assigner Wordfence
Published Apr 12, 2025
Updated Apr 8, 2026
Reserved Apr 4, 2025
Link CVE-2025-3282

CISA Vulnrichment

Updated Apr 14, 2025

NVD

Status Analyzed
Modified Jun 17, 2026
Link CVE-2025-3282

Red Hat

No data

ENISA EUVD

Assigner Wordfence
Published Apr 12, 2025
Updated Apr 8, 2026
Link EUVD-2025-10841

GitHub

No data