CVE-2025-58000: Memberful Plugin Auth Bypass Flaw

CVE-2025-58000 Overview

CVE-2025-58000 is a missing authorization vulnerability in the Memberful - Membership Plugin (memberful-wp) for WordPress. The flaw affects all plugin versions up to and including 1.75.0. Attackers can access functionality that is not properly constrained by access control lists (ACLs). The vulnerability is classified under CWE-862: Missing Authorization and is exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated remote attackers can invoke restricted plugin functionality, leading to limited integrity impact on affected WordPress sites running Memberful <= 1.75.0.

Affected Products

Memberful - Membership Plugin (memberful-wp) versions up to and including 1.75.0
WordPress installations using the Memberful plugin for membership management
Sites relying on Memberful for gated content and subscription workflows

Discovery Timeline

2025-09-22 - CVE-2025-58000 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-58000

Vulnerability Analysis

The Memberful WordPress plugin exposes one or more endpoints or actions that fail to verify the caller's authorization before executing privileged operations. Under [CWE-862], the application performs an action without confirming that the requester holds the required permissions. An unauthenticated attacker can send crafted HTTP requests to the WordPress site and reach functionality intended for authenticated or higher-privileged users.

Because the vulnerability sits in a membership plugin, exposed operations can influence membership-related state or configuration data. The scope is unchanged and confidentiality and availability remain unaffected, while integrity sees limited impact. Attack complexity is low and no privileges are required, making mass scanning of WordPress sites a viable exploitation approach.

The EPSS probability is 0.247% with a percentile of 15.886, indicating a low observed exploitation likelihood at this time. No public proof-of-concept, exploit database entry, or CISA KEV listing exists for this issue.

Root Cause

The root cause is the absence of an authorization check on plugin-exposed handlers. WordPress plugins typically enforce authorization using current_user_can() capability checks or nonce validation on AJAX and REST routes. In memberful-wp versions through 1.75.0, one or more of these guards are missing, allowing callers who lack the necessary role or capability to invoke the handler.

Attack Vector

Attackers exploit the vulnerability remotely by issuing HTTP requests to the WordPress site hosting the vulnerable plugin. The request targets the affected plugin action or endpoint directly, bypassing role and capability checks. No session, credential, or user interaction is required. See the Patchstack Vulnerability Report for technical details on the affected code path.

No verified public exploit code is available for CVE-2025-58000. Refer to the vendor advisory for the specific handler and parameters involved.

Detection Methods for CVE-2025-58000

Indicators of Compromise

Unauthenticated HTTP POST or GET requests to admin-ajax.php or REST routes referencing memberful actions from unusual sources
Unexpected changes to Memberful plugin settings, membership records, or synchronization state without a corresponding administrator login event
Access log entries showing repeated hits to Memberful-related endpoints from a single IP followed by state changes on the site

Detection Strategies

Inventory all WordPress sites and identify installations running memberful-wp version 1.75.0 or earlier using plugin metadata queries
Review web server and WordPress access logs for anonymous requests to plugin action handlers that should require authentication
Correlate outbound requests from the WordPress host to the Memberful API with locally initiated administrative actions to identify unauthorized triggers

Monitoring Recommendations

Enable WordPress audit logging to capture plugin option changes, user role modifications, and administrative actions
Deploy a web application firewall (WAF) rule set that flags unauthenticated access to memberful-wp endpoints
Alert on anomalous request rates or user-agent patterns targeting /wp-admin/admin-ajax.php with action=memberful_* parameters

How to Mitigate CVE-2025-58000

Immediate Actions Required

Upgrade the Memberful - Membership Plugin to a version later than 1.75.0 on all WordPress sites
Audit membership records, user roles, and plugin settings for unauthorized modifications since the plugin was installed
Restrict administrative and AJAX endpoints at the network layer to trusted IP ranges where feasible

Patch Information

Refer to the Patchstack Vulnerability Report for the fixed version and remediation guidance from the vendor. Apply the upstream patch through the standard WordPress plugin update mechanism and verify the reported version after installation.

Workarounds

Temporarily deactivate the Memberful plugin until the patched version is installed if membership functionality is not business-critical
Add WAF rules that block unauthenticated requests to Memberful plugin action handlers and REST routes
Enforce authentication and role checks at the reverse proxy for /wp-admin/ and admin-ajax.php where operational constraints permit

bash

# Verify installed Memberful plugin version using WP-CLI
wp plugin get memberful-wp --field=version

# Update the plugin to the latest available release
wp plugin update memberful-wp