Arbitrary Shortcode Execution in WP-Members Membership Plugin for WordPress
CVE-2025-9489
5MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 9 September 2025
What is CVE-2025-9489?
The WP-Members Membership Plugin for WordPress suffers from a vulnerability that permits arbitrary shortcode execution due to insufficient validation of input values. This issue is present in all versions up to and including 3.5.4.2. Authenticated users with Subscriber-level access or higher can exploit this flaw by executing unauthorized shortcodes, potentially leading to a variety of security breaches.
Affected Version(s)
WP-Members Membership Plugin * <= 3.5.4.2