CVE-2025-2594

Summary

CVE-2025-2594 is a vulnerability affecting the User Registration & Membership plugin for WordPress before version 4.1.3. This issue allows attackers to authenticate as any user, including administrators, by sending malicious data through an AJAX action, even with the Membership Addon enabled. The plugin fails to properly validate this data, leading to unauthorized access to user accounts. This vulnerability poses a significant risk, as administrator accounts can grant attackers full control over the WordPress site. It is recommended that users update to the latest version of the plugin to mitigate this threat.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.