CVE-2025-9489 is a code injection vulnerability in the WP-Members Membership Plugin for WordPress, caused by improper validation of user-supplied input before executing shortcodes via do_shortcode. Authenticated attackers with Subscriber-level privileges or higher can exploit this flaw to execute arbitrary shortcodes, potentially leading to limited confidentiality, integrity, and availability impacts. The vulnerability affects all versions up to 3.5.4.2. The CVSS 3.1 base score is 5.0, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. No patch or official fix is currently documented.

An authenticated user with Subscriber-level access or above can execute arbitrary shortcodes within the WordPress environment, which may lead to limited unauthorized actions affecting confidentiality, integrity, and availability of the affected site. The impact is considered medium severity with a CVSS score of 5.0. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and consider disabling shortcode execution for untrusted users if possible. Monitor for updates from the plugin vendor for an official patch or mitigation instructions.