CVE-2025-2563

high · 8.1

A public exploit / detection template exists

Weaponised detection is publicly available, which meaningfully raises real-world risk regardless of CVSS. nuclei-templates →

The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges

8.1

CVSS

48.5%

EPSS (exploit prob.)

99th

EPSS percentile

2025-04-14

Published

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Vendor	Product	Affected versions
wpeverest	user_registration_&_membership	< 4.1.2
wpeverest	user_registration_&_membership	< 5.1.2

Check a specific version with /api/v1/cve/match.

References

https://wpscan.com/vulnerability/2c0f62a1-9510-4f90-a297-17634e6c8b75/

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2025-2563