Medium severity4.3NVD Advisory· Published Apr 12, 2025· Updated Jun 17, 2026
CVE-2025-3292
CVE-2025-3292
Description
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the 'user_id' user controlled key. This makes it possible for unauthenticated attackers to update other user's passwords, if they have access to the user ID and email.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
4- wpeverest/User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builderv5Range: 0
<=4.1.3+ 1 more
- (no CPE)range: <=4.1.3
- (no CPE)
- cpe:2.3:a:wpeverest:user_registration_\&_membership:*:*:*:*:free:wordpress:*:*Range: <4.1.3
Patches
Vulnerability mechanics
References
3- plugins.trac.wordpress.org/changeset/3268617/user-registration/trunk/includes/class-ur-ajax.phpnvdPatch
- www.wordfence.com/threat-intel/vulnerabilities/id/59a63cd8-9d33-4a2c-a499-5b1ee38c07d6nvdThird Party Advisory
- plugins.trac.wordpress.org/browser/user-registration/tags/4.1.3/includes/class-ur-ajax.phpnvdProduct
News mentions
0No linked articles in our index yet.