CVE-2025-69292
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-26
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wp_membership | wp_membership | From 1.0.0 (inc) to 1.6.4 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-266 | A product incorrectly assigns a privilege to a particular actor, creating an unintended sphere of control for that actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-69292 is a high-priority privilege escalation vulnerability in the WordPress WP Membership Plugin versions up to and including 1.6.4. It allows a malicious user with a low-privileged account, such as a subscriber, to escalate their privileges to a higher level, potentially gaining full control over the affected website. This vulnerability is related to incorrect privilege assignment and is classified under OWASP Top 10 A7: Identification and Authentication Failures. [1]
How can this vulnerability impact me? :
This vulnerability can allow an attacker with minimal access to escalate their privileges and gain full control over your WordPress website. This could lead to unauthorized access, modification, or deletion of data, disruption of website functionality, and potential compromise of sensitive information stored on the site. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix is available for this vulnerability, you should immediately apply the mitigation rule issued by Patchstack to block attacks exploiting this flaw. This mitigation helps protect your site from privilege escalation attempts until an official patch is released. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
There is no specific information provided about detection commands or methods for this vulnerability. However, since the vulnerability affects WordPress WP Membership Plugin versions up to 1.6.4, you can check the plugin version installed on your WordPress site to detect if you are vulnerable. For example, you can use WP-CLI commands such as `wp plugin list` to see the installed plugin versions. Additionally, monitoring for unusual privilege escalations or suspicious user activity might help detect exploitation attempts. Patchstack has issued a mitigation rule to block attacks exploiting this flaw until an official patch is released. [1]