PT-2025-48228 · WordPress · Findall Membership

István Márton · Published 2025-11-27 · Updated 2025-12-02 · CVE-2025-13539

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FindAll Membership plugin for WordPress versions up to and including 1.0.4

Description The FindAll Membership plugin for WordPress is susceptible to an Authentication Bypass issue. The plugin does not properly log in a user after verifying data through the findall membership check facebook user and findall membership check google user functions. This allows unauthenticated attackers to log in as administrative users if they have an existing account on the site and access to the administrative user's email.

Recommendations Update the FindAll Membership plugin to a version later than 1.0.4.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-13539

Affected Products

Findall Membership

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13539 · Security Note
• https://twitter.com/MNovofastovsky/status/1995828234349428815 · Twitter Post
• https://twitter.com/offseq/status/1993923245406384414 · Twitter Post
• https://twitter.com/vuln_tracker/status/1993949463019212922 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a856a96a-68d2-462d-b523-840668980807?source=cve · Note
• https://twitter.com/CVEnew/status/1993906102757376266 · Twitter Post
• https://themeforest.net/item/findall-business-directory-theme/24415962 · Note
• https://t.me/cveNotify/144168 · Telegram Post
• https://twitter.com/CveFindCom/status/1993917978954346661 · Twitter Post
• https://t.me/CVEtracker/38367 · Telegram Post