CVE-2025-13538: Privilege Escalation in FindAll Listing

The impact of this vulnerability is severe. An attacker can exploit it to gain full administrative control over the affected WordPress site. This control allows them to modify content, install malicious plugins, steal sensitive data (user credentials, customer information, financial data), and potentially compromise the entire network if the WordPress site has access to other systems. The requirement for the FindAll Membership plugin to also be active narrows the attack surface somewhat, but still represents a significant risk for sites using both plugins. The ease of exploitation, requiring only a crafted registration request, further amplifies the potential for widespread abuse.

1. Reserved2025-11-22
2. Published2025-11-27
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation is to immediately upgrade the FindAll Listing plugin to version 1.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider temporarily disabling the FindAll Listing plugin. As a secondary measure, review user registration processes and implement stricter role-based access controls within the FindAll Membership plugin, if possible. Monitor WordPress access logs for suspicious registration attempts, particularly those attempting to assign the 'administrator' role. There are no specific WAF rules or Sigma/YARA patterns readily available for this specific vulnerability, but general WordPress security best practices should be followed.