Unauthorized Data Access in YourMembership Single Sign On Plugin for WordPress

CVE-2025-10648

What is CVE-2025-10648?

The YourMembership Single Sign On (YM SSO Login) plugin for WordPress has a vulnerability that allows unauthorized access to profile data. Due to a missing capability check in the 'moym_display_test_attributes' function, all versions up to and including 1.1.7 are at risk. This oversight enables unauthenticated attackers to exploit the vulnerability, potentially exposing sensitive user information. It is crucial for users to review their settings and consider updating to mitigate this risk.

References