CVE-2025-3278 is a critical privilege escalation vulnerability (CWE-269) in the Edge-Themes UrbanGo Membership WordPress plugin. The vulnerability arises because the plugin permits new users to set their own roles during registration by supplying the 'user_register_role' field. This allows unauthenticated attackers to create accounts with administrator privileges, bypassing normal privilege restrictions. The vulnerability affects versions up to and including 1.0.4. The CVSS v3.1 base score is 9.8, reflecting network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability. No patch or remediation details are currently available from the vendor or other sources.

Successful exploitation allows unauthenticated attackers to gain administrator-level access to WordPress sites using the vulnerable UrbanGo Membership plugin. This can lead to complete site compromise, including data theft, site defacement, or further malicious activity. The vulnerability affects all installations running the vulnerable plugin versions without mitigation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the UrbanGo Membership plugin or restricting user registration functionality to trusted users only. Monitor official Edge-Themes communications for updates and apply patches promptly once available.