https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 15:32:42 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-284380 EUVD-2026-284380 https://cve.radiocsirt.org/vuln/euvd-2026-284380 https://cve.radiocsirt.org/vuln/fkie_cve-2025-3292 <p>The User Registration &amp; Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the &#39;user_id&#39; user controlled key. This makes it possible for unauthenticated attackers to update other user&#39;s passwords, if they have access to the user ID and email.</p> <p>The User Registration &amp; Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the &#39;user_id&#39; user controlled key. This makes it possible for unauthenticated attackers to update other user&#39;s passwords, if they have access to the user ID and email.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-3292 https://cve.radiocsirt.org/vuln/ghsa-hc93-f59p-5vw6 <p>The User Registration &amp; Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the &#39;user_id&#39; user controlled key. This makes it possible for unauthenticated attackers to update other user&#39;s passwords, if they have access to the user ID and email.</p> <p>The User Registration &amp; Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the &#39;user_id&#39; user controlled key. This makes it possible for unauthenticated attackers to update other user&#39;s passwords, if they have access to the user ID and email.</p> https://cve.radiocsirt.org/vuln/ghsa-hc93-f59p-5vw6