Flex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation

The impact of CVE-2025-13619 is severe. Successful exploitation allows an attacker to gain full administrative control over the WordPress site. This includes the ability to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and potentially pivot to other systems on the network. The vulnerability's ease of exploitation, requiring only a crafted registration request, significantly increases the risk. The presence of the Flex Store Seller plugin further complicates the attack surface, as the 'fs_type' parameter can be leveraged.

WordPress sites utilizing the Flex Store Users plugin, particularly those running versions 0.0.0 through 1.1.0, are at significant risk. Shared hosting environments where plugin updates are not managed by the site owner are especially vulnerable. Sites that also have the Flex Store Seller plugin installed are at increased risk due to the exploitation via the 'fs_type' parameter.

• wordpress / composer / npm:

grep -r 'fsUserHandle::signup' /var/www/html/wp-content/plugins/flex-store-users/

• wordpress / composer / npm:

grep -r 'fsSellerRole::add_role_seller' /var/www/html/wp-content/plugins/flex-store-users/

• wordpress / composer / npm:

wp plugin list | grep 'flex-store-users'

• wordpress / composer / npm:

wp plugin status flex-store-users

1. 2025-12-20Disclosure

   disclosure

1. Reserviert2025-11-24
2. Veröffentlicht2025-12-20
3. Geändert2026-04-08
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-13619 is to upgrade to a patched version of the Flex Store Users plugin as soon as it becomes available. Until a patch is released, consider implementing temporary workarounds. A Web Application Firewall (WAF) can be configured to block requests containing suspicious parameters, particularly those attempting to assign the 'administrator' role during registration. Additionally, review and restrict user registration permissions within WordPress itself. After applying any mitigation, verify the fix by attempting a user registration with an unauthorized role (e.g., 'administrator') and confirming that the registration fails.