Content *

Overview

A security vulnerability identified as CVE-2025-2594 affects the User Registration & Membership Plugin used with WordPress.

The vulnerability allows attackers to bypass authentication by abusing a vulnerable AJAX endpoint responsible for membership payment confirmation.

By sending specially crafted requests to the endpoint, an attacker may trigger the auto-login functionality, potentially allowing unauthorized access to user accounts.

Affected Software

Vendor: WordPress Plugin Repository

Product: User Registration & Membership Plugin

Affected versions:

• ≤ 4.1.2

Tested environment:

• WordPress 6.x
• Apache Web Server
• Linux

Technical Details

The vulnerability exists in the AJAX endpoint:

/wp-admin/admin-ajax.php

Specifically in the action:

user_registration_membership_confirm_payment

The endpoint accepts parameters including:

• member_id
• security (nonce)
• form_response

Improper validation of these parameters allows attackers to manipulate the request and trigger the auto-login mechanism, resulting in an authentication bypass.

Proof of Concept (PoC)

The following Python script demonstrates the exploitation process.

# place your exploit code here

How the Exploit Works

The exploit performs the following steps:

1. Sends a crafted POST request to the vulnerable AJAX endpoint.
2. Supplies a targeted member_id (often 1, which corresponds to the administrator).
3. Includes a manipulated form_response parameter enabling the auto_login option.
4. If the request is accepted, the attacker may gain authenticated access as the target user.

Usage

Run the exploit with the following command:

python3 exploit.py <target> <member_id> <nonce>

Example:

python3 exploit.py http://targetsite.com 1 123abc_nonce

Parameters:

• target – Base URL of the WordPress website
• member_id – ID of the target user
• nonce – _confirm_payment_nonce obtained from the registration page

Impact

Successful exploitation may allow attackers to:

• Bypass authentication controls
• Gain access to administrator accounts
• Modify website content
• Install malicious plugins or backdoors

Mitigation

Website administrators should:

• Update the plugin to the latest patched version
• Restrict access to sensitive AJAX endpoints
• Implement additional authentication checks
• Monitor unusual login activity

Researcher

Security research conducted by:

Mohammed Idrees Banyamer
Cybersecurity Researcher – Jordan 🇯🇴

Instagram: @banyamer_security
GitHub: https://github.com/mbanyamer

Disclaimer

This proof-of-concept is provided strictly for educational purposes and authorized security testing only. Unauthorized testing against systems without permission is illegal.