CVE-2025-13539

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13539", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-22T05:13:16.600Z", "datePublished": "2025-11-27T04:36:45.704Z", "dateUpdated": "2026-04-08T17:13:52.337Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:13:52.337Z"}, "affected": [{"vendor": "Elated Themes", "product": "FindAll Membership", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the 'findall_membership_check_google_user' functions. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email."}], "title": "FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=cve"}, {"url": "https://themeforest.net/item/findall-business-directory-theme/24415962"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel", "cweId": "CWE-288", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-11-22T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-22T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-26T16:16:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-28T14:42:03.639127Z", "id": "CVE-2025-13539", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-28T19:32:55.733Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13539", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-28T14:42:03.639127Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-28T14:42:04.443Z"}}], "cna": {"title": "FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "Elated Themes", "product": "FindAll Membership", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.0.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-22T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-22T00:00:00.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-26T16:16:27.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=cve"}, {"url": "https://themeforest.net/item/findall-business-directory-theme/24415962"}], "descriptions": [{"lang": "en", "value": "The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the 'findall_membership_check_google_user' functions. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-288", "description": "CWE-288 Authentication Bypass Using an Alternate Path or Channel"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-27T04:36:45.704Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13539", "state": "PUBLISHED", "dateUpdated": "2025-11-28T19:32:55.733Z", "dateReserved": "2025-11-22T05:13:16.600Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-27T04:36:45.704Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FindAll Membership", "vendor": "Elated Themes", "versions": [{"lessThanOrEqual": "1.0.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findall_membership_check_facebook_user' and the 'findall_membership_check_google_user' functions. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email."}, {"lang": "es", "value": "El plugin FindAll Membership para WordPress es vulnerable a omisi\u00f3n de autenticaci\u00f3n en todas las versiones hasta la 1.0.4, inclusive. Esto se debe a que el plugin no inicia sesi\u00f3n correctamente a un usuario con los datos que fueron previamente verificados a trav\u00e9s de las funciones 'findall_membership_check_facebook_user' y 'findall_membership_check_google_user'. Esto hace posible que atacantes no autenticados inicien sesi\u00f3n como usuarios administrativos, siempre y cuando tengan una cuenta existente en el sitio, la cual puede ser creada f\u00e1cilmente por defecto a trav\u00e9s de la funcionalidad de usuario temporal, y acceso al correo electr\u00f3nico del usuario administrativo."}], "id": "CVE-2025-13539", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13539", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-28T14:42:03.639127Z", "version": "2.0.3"}}]}, "published": "2025-11-27T05:16:13.333", "references": [{"source": "security@wordfence.com", "url": "https://themeforest.net/item/findall-business-directory-theme/24415962"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-288"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:16:30.716949+00:00", "value": {"mitigation_remediation": ["Upgrade the FindAll Membership plugin to version 1.0.5 or later.", "Disable the temporary user creation feature and block social login functions if an update is not immediately available.", "Restrict access to administrative user accounts and ensure that admin email addresses are not exposed via public interfaces."], "summary": {"action": "Patch", "impact": "Authentication Bypass"}, "threat_synthesis": {"affected_systems": "This flaw is present in all releases of the FindAll Membership plugin up through version 1.0.4 distributed by Elated Themes. Users deploying the plugin on WordPress sites should review the plugin version and apply any available security updates. No specific WordPress core versions are mentioned as affected, so the vulnerability is confined to the plugin itself.", "description_and_impact": "The FindAll Membership WordPress plugin is vulnerable to an authentication bypass that allows an attacker to log into administrative accounts without valid credentials. The flaw exists because the plugin fails to enforce login session persistence after successful social login checks performed by findall_membership_check_facebook_user and findall_membership_check_google_user. As a result, any user who can create a temporary account and knows the administrative user's email can become an administrator. This vulnerability could allow control over the entire website, including content, site settings, and sensitive data. The weakness maps to CWE\u2011288.", "risk_and_exploitability": "The CVSS score of 9.8 marks it as critical, while the EPSS score of less than 1% suggests a low current exploitation likelihood. The vulnerability is not yet listed in CISA KEV. Attackers would need access to a temporary user account and the victim administrator's email address to exploit the flaw, implying a moderate effort and social engineering component. However, the high severity indicates that once accessed it can lead to complete site compromise."}}}}, "created": "2025-11-27T16:25:51.720190+00:00", "updated": "2026-04-21T01:30:24.383439+00:00", "vendors": ["elated_themes", "elated_themes$PRODUCT$findall_membership", "wordpress", "wordpress$PRODUCT$wordpress"]}