CVE-2025-13538: WordPress FindAll Listing Vulnerability

CVE-2025-13538 Overview

CVE-2025-13538 is a critical Privilege Escalation vulnerability affecting the FindAll Listing plugin for WordPress in all versions up to and including 1.0.5. The vulnerability exists due to improper role restriction in the findall_listing_user_registration_additional_params function, which fails to validate user roles during registration. This allows unauthenticated attackers to register with administrator privileges, gaining full administrative access to the WordPress site.

Critical Impact

Unauthenticated attackers can gain full administrator access to WordPress sites by supplying the 'administrator' role during user registration, potentially leading to complete site takeover.

Affected Products

• FindAll Listing plugin for WordPress versions up to and including 1.0.5
• WordPress sites with both FindAll Listing and FindAll Membership plugins activated
• FindAll Business Directory Theme ecosystem

Discovery Timeline

• 2025-11-27 - CVE-2025-13538 published to NVD
• 2025-12-01 - Last updated in NVD database

Technical Details for CVE-2025-13538

Vulnerability Analysis

This vulnerability is classified under CWE-269 (Improper Privilege Management). The core issue lies in the findall_listing_user_registration_additional_params function within the FindAll Listing plugin, which processes user registration requests without properly validating or restricting the user role parameter.

When a user registers through the WordPress site, the vulnerable function accepts arbitrary role values provided in the registration request. Since there is no server-side validation to ensure that only permitted roles (such as 'subscriber' or 'customer') can be assigned during registration, an attacker can craft a malicious registration request that specifies the 'administrator' role.

It's important to note that this vulnerability requires the FindAll Membership plugin to also be installed and activated, as the user registration functionality resides in that companion plugin. When both plugins are active, the attack surface is exposed.

Root Cause

The root cause is a failure to implement proper access control during the user registration process. The findall_listing_user_registration_additional_params function accepts user-supplied role parameters without validation, trusting client-side input to define user privileges. This violates the principle of least privilege and fails to implement proper server-side authorization checks.

The function should have included a whitelist of acceptable user roles and validated any incoming role parameter against this list before processing the registration. Instead, it blindly accepts whatever role is provided, including privileged roles like 'administrator'.

Attack Vector

The attack is executed over the network and requires no authentication or user interaction. An attacker can exploit this vulnerability by intercepting or crafting a user registration request and modifying the role parameter to 'administrator'. The attack sequence typically involves:

1. Identifying a WordPress site running both FindAll Listing and FindAll Membership plugins
2. Navigating to the user registration page
3. Intercepting the registration request using a proxy tool or crafting a direct POST request
4. Modifying the role parameter to specify 'administrator'
5. Submitting the modified request to create an administrator account
6. Logging in with the newly created administrator credentials

Once administrative access is obtained, the attacker has complete control over the WordPress site, including the ability to modify content, install malicious plugins, access sensitive user data, and potentially compromise the underlying server.

Detection Methods for CVE-2025-13538

Indicators of Compromise

• Unexpected administrator accounts created with recent registration dates
• User registration logs showing unusual role assignments to 'administrator'
• New administrator accounts with suspicious email domains or usernames
• Database entries in wp_users and wp_usermeta tables showing unauthorized admin accounts

Detection Strategies

• Review WordPress user database for recently created administrator accounts that were not authorized
• Monitor registration endpoints for requests containing 'administrator' or other privileged role values
• Implement logging for all user registration activities and role assignments
• Deploy web application firewall (WAF) rules to detect manipulation of role parameters in registration requests

Monitoring Recommendations

• Enable detailed logging on WordPress registration endpoints
• Configure alerts for new administrator account creation events
• Monitor for mass registration attempts that may indicate automated exploitation
• Review access logs for patterns consistent with privilege escalation attempts

How to Mitigate CVE-2025-13538

Immediate Actions Required

• Deactivate the FindAll Listing plugin immediately if running version 1.0.5 or earlier
• Audit existing WordPress administrator accounts and remove any unauthorized entries
• Review user registration logs for signs of exploitation
• Consider temporarily disabling user registration until a patch is applied

Patch Information

As of the last update on 2025-12-01, organizations should check the ThemeForest Business Directory Theme page and the Wordfence Vulnerability Report for the latest patch information and updated plugin versions. Update to the latest patched version as soon as it becomes available.

Workarounds

• Disable the FindAll Listing plugin until an official patch is released
• Implement a custom code snippet or security plugin to restrict role assignment during registration
• Use a WordPress security plugin to add server-side validation for registration role parameters
• If registration functionality is not required, disable WordPress user registration entirely via Settings > General

# Disable WordPress user registration via wp-config.php (temporary workaround)
# Add the following line to your wp-config.php file
define('DISALLOW_FILE_MODS', true);

# Alternatively, use WP-CLI to disable registration
wp option update users_can_register 0

# To audit existing administrator accounts via WP-CLI
wp user list --role=administrator --format=table