CVE-2025-3292 – WordPress User Registration & Membership Insecure Direct Object Reference (IDOR)

CVE ID : CVE-2025-3292

Published : April 12, 2025, 7:15 a.m. | 57 minutes ago

Description : The User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the ‘user_id’ user controlled key. This makes it possible for unauthenticated attackers to update other user’s passwords, if they have access to the user ID and email.

Severity: 4.3 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…