The vulnerability arises from missing validation on the user_id parameter in the User Registration & Membership – Custom Registration Form, Login Form and User Profile plugin. An attacker who can guess or otherwise obtain a target user's ID and email can submit a crafted request to the user_registration_update_profile_details function via an AJAX endpoint and force the plugin to overwrite the target's password. The result is irreversible credential modification that grants the attacker full access to the victim's account, potentially compromising any sensitive content or services associated with that account. The weakness is classified as CWE‑639, illustrating improper restriction of recursive self‑scheduling or data access. Since the plugin performs no check to confirm that the requestor is the legitimate profile owner, the impact is limited to the confidentiality and integrity of the victim's account rather than system-wide exploitation.

All WordPress installations that use the User Registration & Membership – Custom Registration Form, Login Form, and User Profile plugin of version 4.1.3 or earlier. The affected product is published by wpeverest and is commonly titled "User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder." Users running any release through 4.1.3 must review and upgrade.

The CVSS score of 4.3 indicates moderate severity driven by confidentiality impact. The EPSS score is reported as less than 1%, implying a very low probability of real‐world exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, further suggesting limited known exploitation pressure. Even with these low metrics, the potential for an attacker to gain control of victim accounts remains high, especially in sites that expose the AJAX endpoint to unauthenticated users or have weak user enumeration. The attack vector is inferred to be HTTP requests to the AJAX endpoint where the attacker supplies a valid user_id and email pair, potentially via brute force or open directory listings.