FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation

The impact of this vulnerability is severe. An attacker can bypass standard authentication mechanisms and directly gain administrative control over the WordPress site. This grants them complete access to sensitive data, including user credentials, financial information, and website content. They can modify website configurations, install malicious code, deface the site, or even steal the entire database. The requirement for the FindAll Membership plugin to be active adds a layer of dependency, but significantly expands the attack surface if that plugin is deployed.

WordPress sites utilizing both the FindAll Listing and FindAll Membership plugins, particularly those with legacy configurations or those that haven't implemented robust user access controls, are at significant risk. Shared hosting environments where multiple WordPress sites share the same server resources are also vulnerable, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / plugin: Use wp-cli plugin update to check the installed version of FindAll Listing. • wordpress / plugin: Check the wp-config.php file for any unusual configurations related to user roles or registration parameters. • wordpress / plugin: Search plugin files for the findalllistinguserregistrationadditional_params function and its usage. • generic web: Monitor WordPress access logs for POST requests to the user registration endpoint with suspicious parameters, particularly those attempting to set the user role to 'administrator'.

grep -i 'administrator' /var/log/apache2/access.log | grep 'wp-login.php'

1. 2025-11-27Disclosure

   disclosure

1. Reserviert2025-11-22
2. Veröffentlicht2025-11-27
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation is to immediately upgrade the FindAll Listing plugin to version 1.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the 'findalllistinguserregistrationadditional_params' function within the plugin’s code (if possible and safe) to restrict user role assignment during registration. Monitor WordPress access logs for suspicious user registration attempts, particularly those attempting to register with the 'administrator' role. After upgrading, confirm the fix by attempting a user registration with an administrator role and verifying that it is rejected.