CVE-2025-10648: WordPress YM SSO Auth Bypass Vulnerability

CVE-2025-10648 Overview

CVE-2025-10648 affects the YourMembership Single Sign On – YM SSO Login plugin for WordPress in all versions up to and including 1.1.7. The plugin exposes the moym_display_test_attributes function without a capability check, which allows unauthenticated attackers to read the profile data of the most recent Single Sign-On (SSO) login. The flaw is categorized under CWE-862: Missing Authorization and is exploitable over the network without user interaction.

Critical Impact
Unauthenticated attackers can retrieve profile data of the latest SSO login, leading to information disclosure of user attributes handled by the YourMembership integration.

Affected Products

YourMembership Single Sign On – YM SSO Login plugin for WordPress, versions through 1.1.7
WordPress sites using the login-with-yourmembership plugin for YourMembership SSO
Any installation exposing the moym_display_test_attributes handler in class-moym-sso.php

Discovery Timeline

2025-10-15 - CVE-2025-10648 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10648

Vulnerability Analysis

The vulnerability resides in the moym_display_test_attributes function in class-moym-sso.php. The function is registered as a callback but does not verify the caller's WordPress capabilities or nonce before returning data. As a result, any unauthenticated visitor who reaches the endpoint can retrieve the attributes stored from the most recent SSO login transaction. The exposed data may include identifiers, email addresses, and other profile fields synchronized from the YourMembership identity provider.

Because the function is intended for administrative testing of SSO attribute mapping, the sensitive data it returns was never meant to be accessible to unauthenticated users. The absence of a current_user_can() check or equivalent authorization gate converts a diagnostic feature into an information disclosure primitive.

Root Cause

The root cause is a missing authorization check on a WordPress action handler. The moym_display_test_attributes function assumes the caller is a privileged administrator using the plugin's test interface. It does not enforce a capability such as manage_options and does not validate a nonce, so the routing layer accepts requests from any source. This aligns with CWE-862: Missing Authorization.

Attack Vector

An attacker sends an HTTP request to the vulnerable WordPress endpoint that invokes moym_display_test_attributes. No credentials, session, or user interaction are required. The response contains the attributes of the last user who authenticated through the YourMembership SSO flow. Automated scanning against WordPress installations that have the plugin enabled can enumerate exposed sites and harvest disclosed profile data at scale.

Technical references documenting the affected code paths are available in the WordPress plugin source at line 88, the handler at line 112, and the remediation changeset 3389623.

Detection Methods for CVE-2025-10648

Indicators of Compromise

Unauthenticated HTTP requests targeting WordPress action endpoints that invoke moym_display_test_attributes.
Web server access logs containing repeated requests to admin-ajax.php or plugin routes referencing moym parameters from a single external IP.
Outbound responses from the affected site returning JSON or HTML containing SSO user attributes to unauthenticated clients.

Detection Strategies

Inspect access logs for requests referencing moym_display_test_attributes originating from unauthenticated sessions or non-administrative IP ranges.
Correlate WordPress plugin version inventory with the 1.1.7 and earlier version ranges to identify at-risk hosts.
Deploy web application firewall (WAF) signatures that flag requests to the plugin's test attribute handler when the request lacks a valid administrative session cookie.

Monitoring Recommendations

Alert on any HTTP 200 response from the affected endpoint served to a client without a logged-in WordPress session.
Monitor for anomalous scraping patterns against /wp-admin/admin-ajax.php on sites running membership or SSO plugins.
Track the Wordfence advisory for updated indicators and exploitation telemetry.

How to Mitigate CVE-2025-10648

Immediate Actions Required

Update the YourMembership Single Sign On – YM SSO Login plugin to a version later than 1.1.7 that includes the fix from changeset 3389623.
Audit recent web server logs for requests invoking moym_display_test_attributes and identify any profile data that may have been disclosed.
Notify users whose SSO profile data may have been exposed and rotate any credentials or tokens that were transmitted through the affected attribute flow.

Patch Information

The plugin maintainers addressed the missing authorization check in changeset 3389623. Administrators should install the patched release through the WordPress plugin updater and confirm the installed version is greater than 1.1.7. Details are also tracked in the Wordfence Vulnerability Report.

Workarounds

Deactivate the YourMembership SSO plugin until the patched version can be deployed.
Restrict access to WordPress administrative endpoints using IP allow-listing at the reverse proxy or WAF layer.
Block unauthenticated HTTP requests referencing moym_display_test_attributes through custom WAF rules.

bash

# Example WAF rule to block unauthenticated access to the vulnerable handler
# ModSecurity rule
SecRule REQUEST_URI "@contains moym_display_test_attributes" \
    "id:1010648,\
    phase:1,\
    deny,\
    status:403,\
    msg:'Block CVE-2025-10648 YM SSO test attributes handler'"