CVE-2025-12648
📋 TL;DR
The WP-Members WordPress plugin stores user-uploaded files in predictable directories without proper access controls, allowing unauthenticated attackers to guess or enumerate user IDs and filenames to download sensitive documents. This affects all WordPress sites using WP-Members plugin versions up to 3.5.4.4.
💻 Affected Systems
- WP-Members Membership Plugin for WordPress
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Mass exfiltration of sensitive user documents including identification, financial records, or private communications leading to identity theft, financial fraud, or reputational damage.
Likely Case
Targeted extraction of specific user documents through automated enumeration, potentially exposing personal information for blackmail or credential theft.
If Mitigated
No unauthorized access to user files; all file requests properly authenticated and authorized before serving content.
🎯 Exploit Status
Exploitation requires guessing user IDs and filenames, which can be automated through enumeration. No authentication required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.5.4.5
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3427043/wp-members/trunk/includes/class-wp-members-forms.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find WP-Members plugin. 4. Click 'Update Now' if available. 5. Alternatively, download version 3.5.4.5+ from WordPress repository and manually update.
🔧 Temporary Workarounds
Restrict access via .htaccess
linuxAdd proper authentication rules to prevent direct file access
# Add to wp-content/uploads/wpmembers/user_files/.htaccess
Order Deny,Allow
Deny from all
<FilesMatch "\.(jpg|jpeg|png|gif|pdf|doc|docx|xls|xlsx|txt)$">
Require all denied
</FilesMatch>
Disable user file uploads
allTemporarily disable file upload functionality in plugin settings
🧯 If You Can't Patch
- Implement web application firewall rules to block requests to predictable /wp-content/uploads/wpmembers/user_files/ paths
- Move user-uploaded files outside web root or implement server-side authentication checks before serving files
🔍 How to Verify
Check if Vulnerable:
Check plugin version in WordPress admin panel under Plugins → Installed Plugins. If version is 3.5.4.4 or lower, you are vulnerable.Check Version:
wp plugin list --name=wp-members --field=versionVerify Fix Applied:
After updating, test by attempting to access a known user file via direct URL while logged out. Should receive 403/404 error instead of file download.📡 Detection & Monitoring
Log Indicators:
- Multiple 200/206 HTTP responses to /wp-content/uploads/wpmembers/user_files/ patterns from single IPs
- Unusual file download patterns from non-authenticated users
Network Indicators:
- Bursts of GET requests to sequential user ID directories
- Traffic to predictable file paths without referrer or session cookies
SIEM Query:
source="web_logs" AND (uri="/wp-content/uploads/wpmembers/user_files/*" OR uri LIKE "/wp-content/uploads/wpmembers/user_files/%") AND status=200 AND user_agent NOT CONTAINS "bot" | stats count by src_ip🔗 References
- https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/admin/class-wp-members-admin-api.php#L707
- https://plugins.trac.wordpress.org/browser/wp-members/trunk/includes/class-wp-members-forms.php#L604
- https://plugins.trac.wordpress.org/changeset/3427043/wp-members/trunk/includes/class-wp-members-forms.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/9d0154fd-0cab-4445-a92e-c44ae9931479?source=cve
