PT-2025-52547 · WordPress+1 · Flex Store Users+1

Ismail Syaleh · Published 2025-12-20 · Updated 2026-01-02 · CVE-2025-13619

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Flex Store Users plugin for WordPress versions prior to 1.1.1

Description The Flex Store Users plugin for WordPress is susceptible to privilege escalation. Unauthenticated attackers can register with the 'administrator' role during registration, gaining administrator access to the site. This is due to insufficient restrictions within the fsUserHandle::signup and fsSellerRole::add role seller functions regarding user role registration. The fs type parameter is involved when the Flex Store Seller plugin is also activated.

Recommendations Versions prior to 1.1.1 should be updated.

Fix

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2025-13619

Affected Products

Flex Store Seller

Flex Store Users

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2025-13619 · Security Note
• https://themeforest.net/item/autosmart-automotive-car-dealer-wordpress-theme/20322930 · Note
• https://twitter.com/VulmonFeeds/status/2002284245750886601 · Twitter Post
• https://twitter.com/CveFindCom/status/2002282632227205242 · Twitter Post
• https://twitter.com/0dayPublishing/status/2002267852653404279 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2007092491074322541 · Twitter Post
• https://twitter.com/TheHackerWire/status/2002292678244118811 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/a2fc40ed-a6af-4069-be63-cb75e98cc98a?source=cve · Note
• https://t.me/cveNotify/146439 · Telegram Post
• https://t.me/CVEtracker/40340 · Telegram Post
• https://twitter.com/CVEnew/status/2002466743264940033 · Twitter Post