CVE-2025-13539: WordPress FindAll Auth Bypass Flaw

CVE-2025-13539 Overview

The FindAll Membership plugin for WordPress contains an authentication bypass vulnerability affecting all versions up to and including 1.0.4. The flaw resides in the social login flow, specifically the findall_membership_check_facebook_user and findall_membership_check_google_user functions. These functions verify user data but fail to properly authenticate the resulting session, allowing attackers to log in as any existing user — including administrators. Exploitation requires an existing account on the target site, which can be trivially created through the plugin's default temp user functionality, plus knowledge of an administrative user's email address. The vulnerability is tracked as CWE-288: Authentication Bypass Using an Alternate Path or Channel.

Critical Impact
Unauthenticated attackers can gain administrative access to vulnerable WordPress sites by abusing the broken social login verification flow, leading to full site compromise.

Affected Products

FindAll Membership plugin for WordPress, all versions through 1.0.4
WordPress sites running the FindAll Business Directory theme with the bundled membership plugin
Sites with the temp user / social login functionality enabled

Discovery Timeline

2025-11-27 - CVE-2025-13539 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-13539

Vulnerability Analysis

The FindAll Membership plugin implements social login via Facebook and Google. The functions findall_membership_check_facebook_user and findall_membership_check_google_user are responsible for verifying that a user record matches data supplied during the social login handshake. After verification, the plugin logs the user into the WordPress session.

The defect lies in the trust boundary between verification and session establishment. The plugin authenticates the session based on attacker-influenced input rather than on a cryptographically validated assertion from the identity provider. An attacker who controls the input bound to an administrator's email can therefore complete the login flow and receive administrator privileges.

Full administrative access on WordPress permits arbitrary plugin and theme installation, PHP code execution through the theme editor, database modification, and persistent backdoor deployment.

Root Cause

The root cause is improper authentication [CWE-288]. The plugin treats the presence of a matching user record as sufficient grounds to call WordPress login primitives, without ensuring the requester actually controls the corresponding social identity. The temp user feature compounds the issue by allowing attackers to bootstrap a low-privilege account that the flawed login flow can then escalate.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker first registers a temp user account on the target site. The attacker then invokes the social login endpoints, supplying the target administrator's email as the identifying attribute. The vulnerable check functions accept the data and the plugin establishes an authenticated session as the administrator.

No verified proof-of-concept code is published. See the Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2025-13539

Indicators of Compromise

Unexpected successful logins to administrator accounts originating from the social login endpoints exposed by the FindAll Membership plugin
New temp user registrations followed shortly by administrative session creation from the same IP or user agent
Plugin, theme, or wp-config.php modifications performed by administrator accounts that do not normally make such changes
New administrative users, scheduled tasks (wp_cron), or unrecognized PHP files added under wp-content/

Detection Strategies

Monitor WordPress authentication logs for administrator logins that lack a corresponding password authentication event
Alert on calls to findall_membership_check_facebook_user or findall_membership_check_google_user followed by wp_set_auth_cookie for privileged accounts
Correlate temp user account creation with subsequent privilege escalation within the same session lineage

Monitoring Recommendations

Forward WordPress access logs and wp-login.php events to a centralized log platform for retention and correlation
Track file integrity on wp-content/plugins/, wp-content/themes/, and core WordPress files
Review administrator account inventory daily until the plugin is patched or removed

How to Mitigate CVE-2025-13539

Immediate Actions Required

Deactivate and remove the FindAll Membership plugin until a patched version is confirmed available from the vendor
Rotate passwords and invalidate active sessions for all administrator accounts on affected WordPress installations
Audit the user list for unauthorized administrator accounts and remove any that are not recognized
Disable temp user registration and social login features while the plugin remains installed

Patch Information

No fixed version has been published in the NVD record at the time of writing. Versions up to and including 1.0.4 are affected. Monitor the ThemeForest Product Listing and the Wordfence Vulnerability Report for updates from the vendor.

Workarounds

Block public access to the plugin's social login endpoints at the web application firewall layer
Restrict /wp-admin/ access to known administrator source IP ranges using web server rules or a WAF
Enforce multi-factor authentication on all WordPress administrator accounts so a hijacked session prompt cannot fully take over the account
Remove or disable the FindAll Membership plugin entirely if social login is not a business requirement

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate findall-membership
wp plugin delete findall-membership

# List administrator accounts for review
wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

# Force logout of all active sessions
wp user session destroy --all --all-users