CVE-2025-12648: 
WordPress vulnerability analysis and mitigation

CVE-2025-12648 is an unauthorized file access vulnerability in the WP-Members Membership Plugin for WordPress, classified under CWE-552 (Files or Directories Accessible to External Parties). It affects all versions up to and including 3.5.4.4, and was disclosed on January 7, 2026, by Wordfence. The flaw allows unauthenticated attackers to directly download sensitive user-uploaded files by guessing or enumerating predictable directory paths. It carries a CVSS v3.1 base score of 5.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is improper access control (CWE-552): user-uploaded files are stored in a predictable directory structure — wp-content/uploads/wpmembers/user_files/<user_id>/ — with only a .htaccess file configured to disable directory listing (Options -Indexes). This protection does not prevent direct URL access to files when the path is known or guessed. Relevant code paths are visible in class-wp-members-admin-api.php (line 707) and class-wp-members-forms.php (line 604), and a patch was applied in changeset 3427043 (WordPress Trac, Wordfence).

Successful exploitation allows unauthenticated remote attackers to access and download sensitive documents uploaded by registered site users, such as identity documents, contracts, or other private files submitted through membership forms. The impact is limited to confidentiality — there is no integrity or availability impact — but the exposure of personally identifiable information (PII) or sensitive membership data could have significant privacy and compliance consequences for affected site operators (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, exploitation requires no authentication and only low complexity — an attacker needs only to enumerate or guess WordPress user IDs and uploaded filenames (Wordfence).

1. Reconnaissance: Identify WordPress sites running the WP-Members Membership Plugin (version ≤ 3.5.4.4) using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible readme.txt files.
2. User ID enumeration: Enumerate WordPress user IDs via the REST API (/wp-json/wp/v2/users) or by observing author archive URLs (/?author=1, /?author=2, etc.) to build a list of valid user IDs.
3. Filename guessing: Attempt to guess or brute-force filenames of uploaded documents. Common patterns may include original filenames submitted during registration (e.g., id_card.pdf, contract.docx).
4. Direct URL access: Construct and request URLs in the format https://<target>/wp-content/uploads/wpmembers/user_files/<user_id>/<filename> directly in a browser or via curl/wget.
5. File download: If the file exists and the server does not enforce additional access controls, the file is returned directly, allowing the attacker to download sensitive user documents (Wordfence, WordPress Trac).

• Network: Unusual HTTP GET requests to paths matching wp-content/uploads/wpmembers/user_files/<numeric_id>/<filename> from external or unknown IP addresses, especially in rapid succession suggesting enumeration.
• Logs: Web server access logs showing sequential requests across multiple user ID directories (e.g., /user_files/1/, /user_files/2/, /user_files/3/) with 200 OK responses for file downloads.
• Logs: High volume of 404 responses to the wpmembers/user_files/ path, indicating filename or user ID brute-forcing attempts.
• Network: Requests to the WordPress REST API endpoint /wp-json/wp/v2/users from the same source IP shortly before file access attempts, suggesting user ID enumeration as a precursor.

The vulnerability was patched in WP-Members Membership Plugin version 3.5.4.5 or later via changeset 3427043, which implements proper access controls for user-uploaded files. Site administrators should update the plugin immediately to the latest available version through the WordPress plugin dashboard. As a temporary workaround, administrators can add server-level rules (e.g., Apache mod_rewrite or Nginx location blocks) to deny direct HTTP access to the wp-content/uploads/wpmembers/user_files/ directory, or relocate uploaded files outside the web root (WordPress Trac, Wordfence).

Sucuri included CVE-2025-12648 in their January 2026 vulnerability patch roundup, highlighting it as one of several WordPress plugin issues requiring prompt attention (Sucuri Blog). No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been identified.