CVE-2025-9085

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9085", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-08-15T16:37:03.929Z", "datePublished": "2025-09-06T02:24:17.930Z", "dateUpdated": "2026-04-08T17:18:12.292Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:18:12.292Z"}, "affected": [{"vendor": "wpeverest", "product": "User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.3.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "title": "User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba326241-46a3-4891-a180-d7977f4e83ed?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/4.3.0/modules/membership/includes/Admin/Repositories/MembersRepository.php#L116"}, {"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/4.3.0/modules/membership/includes/Admin/Members/MembersListTable.php#L45"}, {"url": "https://plugins.trac.wordpress.org/changeset/3351639/user-registration/tags/4.4.0/modules/membership/includes/Admin/Repositories/MembersRepository.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "cweId": "CWE-89", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jack Pas"}], "timeline": [{"time": "2025-08-15T16:52:16.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-05T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-25T14:14:42.961669Z", "id": "CVE-2025-9085", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-25T14:14:47.147Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9085", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-25T14:14:42.961669Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-08T20:14:01.475Z"}}], "cna": {"title": "User Registration & Membership <= 4.3.0 - Authenticated (Admin+) SQL Injection", "credits": [{"lang": "en", "type": "finder", "value": "Jack Pas"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"}}], "affected": [{"vendor": "wpeverest", "product": "User Registration & Membership \u2013 Custom Registration Form Builder, Custom Login Form, User Profile, Content Restriction & Membership Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.3.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-15T16:52:16.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-05T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba326241-46a3-4891-a180-d7977f4e83ed?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/4.3.0/modules/membership/includes/Admin/Repositories/MembersRepository.php#L116"}, {"url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/4.3.0/modules/membership/includes/Admin/Members/MembersListTable.php#L45"}, {"url": "https://plugins.trac.wordpress.org/changeset/3351639/user-registration/tags/4.4.0/modules/membership/includes/Admin/Repositories/MembersRepository.php"}], "descriptions": [{"lang": "en", "value": "The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-09-06T02:24:17.930Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9085", "state": "PUBLISHED", "dateUpdated": "2025-11-25T14:14:47.147Z", "dateReserved": "2025-08-15T16:37:03.929Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-06T02:24:17.930Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "User Registration & Membership \u2013 Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder", "vendor": "wpeverest", "versions": [{"lessThanOrEqual": "4.3.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The User Registration & Membership plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in version 4.3.0. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database."}], "id": "CVE-2025-9085", "lastModified": "2026-06-17T10:08:17.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9085", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-25T14:14:42.961669Z", "version": "2.0.3"}}]}, "published": "2025-09-06T03:15:41.587", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/4.3.0/modules/membership/includes/Admin/Members/MembersListTable.php#L45"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/user-registration/tags/4.3.0/modules/membership/includes/Admin/Repositories/MembersRepository.php#L116"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3351639/user-registration/tags/4.4.0/modules/membership/includes/Admin/Repositories/MembersRepository.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ba326241-46a3-4891-a180-d7977f4e83ed?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:43:06.400689+00:00", "value": {"mitigation_remediation": ["Upgrade the User Registration & Membership plugin to version\u202f4.4.0 or later, which removes the vulnerable code.", "Limit administrator\u2011level access to trusted personnel and enforce least\u2011privilege permissions to reduce the attack surface.", "Perform a thorough review of the WordPress installation for additional outdated or vulnerable plugins and apply any available security updates immediately."], "summary": {"action": "Upgrade Now", "impact": "SQL Injection \u2013 potential data exfiltration."}, "threat_synthesis": {"affected_systems": "WordPress sites running the User Registration & Membership (wpeverest) plugin version 4.3.0 or earlier are affected. The vulnerability is present in the Admin/Members/MembersListTable.php and Admin/Repositories/MembersRepository.php files as referenced in the official plugin repository.", "description_and_impact": "The User Registration & Membership plugin for WordPress is vulnerable to SQL injection via the 's' parameter in version 4.3.0. The flaw stems from insufficient escaping of user input and the absence of prepared statements, allowing an attacker with administrator\u2011level access to append arbitrary SQL clauses. This can lead to the extraction or alteration of sensitive data stored in the WordPress database. The weakness is identified as CWE\u201189.", "risk_and_exploitability": "The CVSS score of 4.9 indicates a moderate risk profile, while the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated attacker with administrator or higher privileges; thus, the attack vector is private, limited to users with valid admin credentials. If exploited, an attacker could read protected data from the WordPress database, potentially compromising user accounts and site integrity."}}}}, "created": "2026-04-20T19:45:15.512210+00:00", "updated": "2026-04-20T19:45:15.512228+00:00", "vendors": []}