CVE-2025-13539: WordPress FindAll Plugin Auth Bypass

CVE-2025-13539 Overview

CVE-2025-13539 is a critical authentication bypass vulnerability affecting the FindAll Membership plugin for WordPress. The vulnerability exists in all versions up to and including 1.0.4 due to improper user authentication handling in the social login functionality. Specifically, the plugin fails to properly authenticate users with data previously verified through the findall_membership_check_facebook_user and findall_membership_check_google_user functions.

This flaw enables unauthenticated attackers to log in as administrative users under specific conditions. The attacker requires an existing account on the target WordPress site (which can be created through the default temp user functionality) and access to the administrative user's email address. Once these prerequisites are met, an attacker can bypass authentication and gain full administrative access to the WordPress installation.

Critical Impact

Unauthenticated attackers can bypass authentication to gain administrative access to WordPress sites, potentially leading to complete site compromise, data theft, malware injection, and defacement.

Affected Products

• FindAll Membership Plugin for WordPress versions ≤ 1.0.4
• WordPress installations using FindAll Membership with social login features enabled
• Websites using the FindAll Business Directory Theme

Discovery Timeline

• 2025-11-27 - CVE-2025-13539 published to NVD
• 2025-12-01 - Last updated in NVD database

Technical Details for CVE-2025-13539

Vulnerability Analysis

This authentication bypass vulnerability (CWE-288: Authentication Bypass Using an Alternate Path or Channel) stems from a fundamental flaw in how the FindAll Membership plugin handles social authentication flows. The plugin implements Facebook and Google login functionality but fails to properly bind the authenticated session to verified user credentials.

When a user attempts to authenticate via social login, the plugin's findall_membership_check_facebook_user and findall_membership_check_google_user functions verify the user's identity through the respective OAuth providers. However, after this verification step, the plugin does not adequately enforce that the subsequent login operation uses only the verified data. This disconnect between verification and session establishment creates an exploitable window.

The attack is facilitated by the plugin's default temp user functionality, which allows anyone to create accounts on the site. An attacker can leverage this feature to establish a foothold, then exploit the authentication bypass to escalate to administrative privileges.

Root Cause

The root cause is improper implementation of the authentication state machine in the social login workflow. The plugin performs OAuth verification as a separate step from session establishment, but does not cryptographically bind these operations together. The functions responsible for checking Facebook and Google user credentials do not pass authentication tokens securely to the login routine, allowing an attacker to manipulate the login process after the initial OAuth verification succeeds.

This is a classic case of broken authentication where the verification step and the authorization step are decoupled, creating a race condition or parameter manipulation opportunity that bypasses the intended security controls.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction to exploit. An attacker would follow these steps:

1. Identify a WordPress site running a vulnerable version of FindAll Membership plugin
2. Create an account using the temp user functionality (enabled by default)
3. Obtain or guess the email address of an administrative user
4. Initiate the social login flow and manipulate the authentication request
5. Exploit the improper session binding to authenticate as the administrator

The vulnerability allows remote exploitation over the network without requiring any form of authentication, making it highly dangerous for exposed WordPress installations.

Due to the sensitive nature of this vulnerability and the lack of verified proof-of-concept code, the exploitation mechanism is described in prose. Technical details regarding the specific parameter manipulation or request forgery techniques should be obtained from the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-13539

Indicators of Compromise

• Unexpected administrative logins or session creations from unfamiliar IP addresses
• New user accounts created through the temp user functionality preceding administrative access
• Unusual activity in WordPress admin panels including plugin installations, theme modifications, or user privilege changes
• Authentication logs showing social login attempts for administrative accounts from suspicious sources

Detection Strategies

• Review WordPress authentication logs for anomalous social login patterns targeting administrative accounts
• Monitor for new temp user account creations followed by privilege escalation attempts
• Implement Web Application Firewall (WAF) rules to detect manipulation of OAuth callback parameters
• Deploy SentinelOne Singularity for real-time endpoint monitoring and behavioral analysis of web server processes

Monitoring Recommendations

• Enable verbose logging for the FindAll Membership plugin to capture authentication flow details
• Configure alerting for any administrative login events, especially those using social authentication
• Monitor web server access logs for unusual patterns in the OAuth callback endpoints
• Implement file integrity monitoring for WordPress core files and plugin directories

How to Mitigate CVE-2025-13539

Immediate Actions Required

• Immediately update the FindAll Membership plugin to a patched version when available
• Disable the social login functionality in the FindAll Membership plugin settings until a patch is applied
• Disable the temp user functionality to prevent attackers from establishing accounts
• Audit existing user accounts and remove any suspicious or unauthorized accounts
• Reset administrative user passwords and implement additional authentication factors

Patch Information

At the time of publication, site administrators should check the ThemeForest product page for updates to the FindAll Business Directory Theme and associated plugins. Monitor the Wordfence Vulnerability Report for patch availability announcements.

Workarounds

• Completely disable the FindAll Membership social login features until an official patch is released
• Restrict administrative account email addresses to internal-only addresses not publicly discoverable
• Implement IP-based access restrictions for the WordPress admin panel (/wp-admin/)
• Deploy a Web Application Firewall (WAF) with rules to filter OAuth callback manipulation attempts
• Consider temporarily deactivating the FindAll Membership plugin if social login functionality is not critical

# WordPress wp-config.php - Disable user registration as temporary mitigation
define('USERS_CAN_REGISTER', false);

# Apache .htaccess - Restrict wp-admin access by IP
<Directory /var/www/html/wp-admin>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from 10.0.0.0/8
</Directory>