CVE-2025-2563 User Registration & Membership < 4.1.2- Unauthenticated Privilege Escalation

What is CVE-2025-2563?

CVE-2025-2563 is a high-severity vulnerability in Unknown User Registration & Membership, published on 14 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges

Which versions are affected by CVE-2025-2563?

It affects 1 product.

Products include Wpeverest User Registration \& Membership.

How do I fix CVE-2025-2563?

No fix has been published for CVE-2025-2563 yet. Limit exposure of the affected software until one is available.

Is CVE-2025-2563 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-2563 exists.

Public exploit code: 1 Metasploit module, 1 Nuclei template and 4 proofs of concept on GitHub.

Other vulnerabilities in Unknown User Registration & Membership

• CVE-2025-2594 User Registration & Membership < 4.1.3 - Authentication Bypass High 8.1
• CVE-2023-27459 WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerability High 7.4
• CVE-2025-39400 WordPress User Registration plugin < 4.2.0 - Reflected Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2025-30899 WordPress User Registration plugin <= 4.0.3 - Cross Site Scripting (XSS) vulnerability Medium 5.9
• CVE-2025-3282 Missing authorization in User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder Medium 5.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jxh5-f52q-732j.