CVE-2025-9489: WP-Members Membership Plugin <= 3.5.4.2 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via Profile Names
The The WP-Members Membership Plugin plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.5.4.2. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-9489?
CVE-2025-9489 is rated as a high severity vulnerability due to its potential for arbitrary shortcode execution.
How do I fix CVE-2025-9489?
To fix CVE-2025-9489, update the WP-Members Membership Plugin to the latest version beyond 3.5.4.2.
What versions of WP-Members Membership Plugin are affected by CVE-2025-9489?
CVE-2025-9489 affects all versions of the WP-Members Membership Plugin up to and including 3.5.4.2.
What are the potential impacts of CVE-2025-9489?
The potential impacts of CVE-2025-9489 include unauthorized execution of arbitrary code via shortcode, leading to complete site compromise.
Is there a patch available for CVE-2025-9489?
Yes, a patch is available by upgrading to the latest version of the WP-Members Membership Plugin.