The wpeverest User Registration & Membership plugin for WordPress versions up to 4.1.3 contains an authorization bypass vulnerability (CWE-639) due to lack of validation on the 'user_id' parameter in the user_registration_update_profile_details() function. This allows unauthenticated attackers to perform insecure direct object reference attacks by supplying arbitrary user IDs, enabling them to update other users' passwords if they also have access to the corresponding email addresses. The CVSS 3.1 base score is 4.3 (medium severity) with network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker who knows a valid user ID and email can update that user's password without authentication, potentially leading to account takeover. The impact is limited to integrity as confidentiality and availability are not affected. There are no known exploits in the wild. The vulnerability affects all versions up to and including 4.1.3 of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the user ID and email information and monitor for suspicious activity related to password changes. Avoid using affected versions of the plugin in sensitive environments if possible.