CVE-2025-2563: unknown user registration & membership Improper Privilege Management

CVSS: 9.8v3.1CriticalAnalyzed

Published 14-04-2025Last modified 27-08-2025

Vulnerability summary

CVE-2025-2563 is a critical (CVSS 9.8) Improper Privilege Management vulnerability in unknown user registration & membership. EPSS estimates a 48.80% chance of exploitation in the next 30 days, higher than 98.8% of scored vulnerabilities. 2 public exploits are recorded. Fixed in 4.1.2.

Overall risk

70/100

0100

High · default modelHow is this calculated?

CVSS score

9.8/10

010

Critical · v3.1 (wordfence)

EPSS score

48.80%

0%100%

High · +0.31 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits2reference, metasploit

Timeline

14-04-2025
PublishedVulnerability first disclosed.
27-08-2025
Last modifiedVulnerability information updated.

Description

The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges

CVSS metrics

3 scores · 3 sources · 1 version

v3.19.8

EPSS trend

Probability

48.80%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

+0.31 pp

From 48.50% on 19-09-2026

19-09-202619-10-2026

EPSS score

48.80%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found

referenceUnverified
Exploit Reference (wpscan.com)
Maturity: unknown
MetasploitremoteVerified
WP User Registration and Membership Unauthenticated Privilege Escalation (CVE-2025-2563)
exploit/multi/http/wp_user_registration_membership_escalation
Maturity: weaponized