CVE-2025-3281: WordPress User Registration Auth Bypass

CVE-2025-3281 Overview

CVE-2025-3281 affects the User Registration & Membership plugin for WordPress, which provides custom registration forms, login forms, and user profile functionality. The vulnerability is an Insecure Direct Object Reference [CWE-639] in the create_stripe_subscription() function. All plugin versions up to and including 4.2.1 fail to validate the user-controlled member_id key. Unauthenticated attackers can exploit this flaw over the network to delete arbitrary user accounts registered through the plugin.

Critical Impact
Unauthenticated attackers can remotely delete arbitrary user accounts registered through the affected WordPress plugin, disrupting site membership and access.

Affected Products

WordPress User Registration & Membership plugin versions up to and including 4.2.1
Custom Registration Form, Login Form, and User Profile functionality provided by the plugin
WordPress sites using the plugin's Stripe subscription integration

Discovery Timeline

2025-05-06 - CVE-2025-3281 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-3281

Vulnerability Analysis

The flaw resides in the create_stripe_subscription() AJAX handler within the plugin's membership module. The function accepts a member_id parameter from the client request and acts on the referenced account without verifying that the requester is authorized to operate on that account. Because the endpoint is reachable without authentication, an attacker can supply any valid member_id and trigger account deletion for that user.

The issue is a classic Insecure Direct Object Reference. The plugin trusts a user-controlled identifier to select the target object and skips both authentication and ownership checks before performing a destructive action.

Root Cause

The root cause is missing authorization on the member_id parameter processed by create_stripe_subscription(). The function does not verify that the current session owns the referenced member record and does not require an authenticated session at all. See the pre-patch source in the WordPress User Registration AJAX Code and the vendor fix in the WordPress User Registration Changeset.

Attack Vector

An unauthenticated remote attacker sends a crafted AJAX request to the vulnerable endpoint with an arbitrary member_id value. The plugin processes the request and deletes the user account associated with the supplied identifier. Attackers can enumerate identifiers sequentially to remove multiple accounts. Additional technical detail is available in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-3281

Indicators of Compromise

Unexpected deletion of user accounts that registered through the User Registration & Membership plugin
Anonymous POST requests to admin-ajax.php invoking the create_stripe_subscription action with varying member_id values
Spikes in unauthenticated AJAX traffic containing sequential or enumerated member_id parameters

Detection Strategies

Inspect web server access logs for unauthenticated requests to wp-admin/admin-ajax.php referencing the membership subscription action
Correlate WordPress user deletion audit events with anonymous HTTP requests to the plugin's AJAX endpoint
Compare active plugin version against 4.2.1 and flag installations at or below that release

Monitoring Recommendations

Alert on repeated admin-ajax.php calls from a single source with iterating member_id parameter values
Track user table changes and reconcile deletions against expected administrative activity
Monitor plugin file integrity for the membership module to detect unauthorized modifications

How to Mitigate CVE-2025-3281

Immediate Actions Required

Update the User Registration & Membership plugin to a version later than 4.2.1 that includes the fix from changeset 3287698
Audit the WordPress user table for unexpected deletions and restore accounts from backup where necessary
Restrict access to admin-ajax.php from untrusted sources using a web application firewall until patched

Patch Information

The vendor addressed the missing authorization in the WordPress User Registration Changeset. Site operators should upgrade to the fixed plugin release that contains this commit. Verify the installed version through the WordPress admin plugin listing after the update.

Workarounds

Disable the User Registration & Membership plugin until the patched version can be installed
Deploy WAF rules that block unauthenticated requests to the create_stripe_subscription AJAX action
Take regular backups of the WordPress user database to enable rapid recovery of deleted accounts

bash

# Example WAF rule concept to block unauthenticated calls to the vulnerable action
# Reject POST requests to admin-ajax.php where action=create_stripe_subscription
# and no valid authenticated WordPress session cookie is present
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,deny,status:403,id:1002025328,msg:'Block CVE-2025-3281 IDOR attempt'"
  SecRule ARGS:action "@streq create_stripe_subscription" \
    "chain"
    SecRule &REQUEST_COOKIES:/wordpress_logged_in_/ "@eq 0"