CVE-2025-2563
HIGH EXPLOITED NUCLEIUser Registration & Membership <= 4.1.1 - Unauthenticated Privilege Escalation
Title source: nucleiExploitation Summary
CVE-2025-2563 has been observed exploited in the wild (reported by VulnCheck KEV).
EIP tracks 5 public exploits from researchers including dokter69, Nxploited, 0axz-tools, including a Metasploit module exploits/multi/http/wp_user_registration_membership_escalation.
A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional Python exploit for CVE-2025-2563, targeting a WordPress membership plugin vulnerability. The exploit automates user registration, email bypass, and admin privilege escalation through crafted HTTP requests and nonce extraction.
Description
The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges
Exploits (5)
This repository contains a functional Python exploit for CVE-2025-2563, targeting a WordPress membership plugin vulnerability. The exploit automates user registration, email bypass, and admin privilege escalation through crafted HTTP requests and nonce extraction.
The repository contains a functional Python exploit for CVE-2025-2563, targeting a WordPress membership plugin vulnerability. The script automates user registration and privilege escalation by extracting nonces and form data from the target site.
This repository provides a detailed writeup and proof-of-concept for CVE-2025-2563, an unauthenticated privilege escalation vulnerability in the User Registration & Membership WordPress plugin. The exploit allows attackers to create administrator accounts under specific conditions.
This Metasploit module exploits CVE-2025-2563 in the WordPress User Registration & Membership plugin, allowing unauthenticated privilege escalation to administrator by registering a user, elevating privileges via AJAX, and uploading/executing a PHP payload.
Nuclei Templates (1)
body="/wp-content/plugins/user-registration"
References (1)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H