PT-2025-50301 · WordPress · Elated Membership

Friderika Baranyai · Published 2025-12-10 · Updated 2025-12-15 · CVE-2025-13613

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Elated Membership plugin for WordPress versions prior to 1.3

Description The Elated Membership plugin for WordPress is susceptible to Authentication Bypass in versions up to 1.2. The plugin does not properly log in a user when data is verified through the eltdf membership check facebook user and eltdf membership login user from social network functions. This allows unauthenticated attackers to log in as administrative users if they have an existing account on the site, which can be created through the temporary user functionality.

Recommendations Update the Elated Membership plugin to version 1.3 or later.

Fix

Weakness Enumeration

CWE-289

Related Identifiers

CVE-2025-13613

Affected Products

Elated Membership

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-13613 · Security Note
• https://themeforest.net/item/esmarts-a-modern-education-and-lms-theme/20987760 · Note
• https://t.me/CVEtracker/39328 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1998648770586640419 · Twitter Post
• https://t.me/cveNotify/145289 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/f15dbce4-2e94-4735-b62b-e32d923c51ce?source=cve · Note
• https://twitter.com/offseq/status/1998657207035121664 · Twitter Post
• https://twitter.com/CVEnew/status/1998732753941168214 · Twitter Post
• https://twitter.com/CveFindCom/status/1998598287994016046 · Twitter Post
• https://twitter.com/cracbot/status/2000521272254738899 · Twitter Post