CVE-2025-12648: WP-Members Membership Plugin <= 3.5.4.4 - Unauthenticated Information Exposure via Unprotected Files
The WP-Members Membership Plugin for WordPress is vulnerable to unauthorized file access in versions up to, and including, 3.5.4.4. This is due to storing user-uploaded files in predictable directories (wp-content/uploads/wpmembers/userfiles/<userid>/) without implementing proper access controls beyond basic directory listing protection (.htaccess with Options -Indexes). This makes it possible for unauthenticated attackers to directly access and download sensitive documents uploaded by site users via direct URL access, granted they can guess or enumerate user IDs and filenames.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-12648?
CVE-2025-12648 is considered a moderate severity vulnerability due to the potential for unauthorized file access.
How do I fix CVE-2025-12648?
To fix CVE-2025-12648, update the WP-Members Membership Plugin to the latest version above 3.5.4.4.
What versions are affected by CVE-2025-12648?
CVE-2025-12648 affects all versions of the WP-Members Membership Plugin up to and including 3.5.4.4.
What causes CVE-2025-12648?
CVE-2025-12648 is caused by the predictable storage of user-uploaded files in accessible directories without proper access controls.
Who is vulnerable to CVE-2025-12648?
Any WordPress site using the WP-Members Membership Plugin version 3.5.4.4 or earlier is vulnerable to CVE-2025-12648.