Most recent entries from all https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 23:38:52 +0000 CVE-2025-3292 — User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.1.3 - Insecure Direct Obje… https://cve.radiocsirt.org/vuln/cve-2025-3292 <p><strong>Affected:</strong> wpeverest User Registration &amp; Membership – Free &amp; Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration &amp; Login Builder</p> <p>The User Registration &amp; Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the &#39;user_id&#39; user controlled key. This makes it possible for unauthenticated attackers to update other user&#39;s passwords, if they have access to the user ID and email.</p> <p><strong>Affected:</strong> wpeverest User Registration &amp; Membership – Free &amp; Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration &amp; Login Builder</p> <p>The User Registration &amp; Membership – Custom Registration Form, Login Form, and User Profile plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.3 via the user_registration_update_profile_details() due to missing validation on the &#39;user_id&#39; user controlled key. This makes it possible for unauthenticated attackers to update other user&#39;s passwords, if they have access to the user ID and email.</p> https://cve.radiocsirt.org/vuln/cve-2025-3292