CVE-2025-3282: User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Object Reference to Unauthenticated Membership Modification
The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the userregistrationmembershipregistermember() due to missing validation on the 'membershipid' user controlled key. This makes it possible for unauthenticated attackers to update any user's membership to any other active or non-active membership type.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-3282?
CVE-2025-3282 is rated as a medium severity vulnerability due to its potential for unauthorized access to user data.
How do I fix CVE-2025-3282?
To fix CVE-2025-3282, update the User Registration & Membership plugin to version 4.1.4 or higher.
What specific functionality is affected by CVE-2025-3282?
CVE-2025-3282 affects the user_registration_membership_register_member() function in the User Registration & Membership plugin.
Who is affected by CVE-2025-3282?
Any website using versions of the User Registration & Membership plugin up to and including 4.1.3 is affected by CVE-2025-3282.
What kind of attack does CVE-2025-3282 allow?
CVE-2025-3282 allows for Insecure Direct Object Reference, potentially allowing attackers to access and manipulate user data.