VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Apr 12, 2025· Updated Jun 17, 2026

CVE-2025-3282

CVE-2025-3282

Description

The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_membership_register_member() due to missing validation on the 'membership_id' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4
  • wpeverest/User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builderv5
    Range: 0
  • Wpeverest/User Registration \& Membership
    cpe:2.3:a:wpeverest:user_registration_\&_membership:*:*:*:*:free:wordpress:*:*
    Range: <4.1.4
  • WordPress/User Registration \& Membershipllm-fuzzy2 versions
    <=4.1.3+ 1 more
    • (no CPE)range: <=4.1.3
    • (no CPE)

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.