External risk intelligence

FindAll Listing WordPress Plugin Privilege Escalation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-13538

The vulnerability exists in a WordPress plugin that handles user registration. WordPress sites with user registration enabled are designed to be public-facing by default, and this flaw allows unauthenticated remote attackers to register and escalate privileges on such internet-accessible endpoints.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in the FindAll Listing WordPress plugin, when used with the FindAll Membership plugin, could allow unauthenticated attackers to gain administrator access to a website. This issue stems from a failure to properly restrict user roles during registration.

Unauthenticated users could gain administrator rights.
Matters because public registration can be compromised.
Confirm if this plugin combination is in use.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker could exploit this vulnerability by first ensuring the FindAll Membership plugin is active on the target WordPress site. Then, they could register a new user and, by manipulating the registration parameters, assign themselves the administrator role. This would grant them full administrative control over the website.

No authentication required.
Register with administrator role.
Gain full site control.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to gain administrator access to a WordPress site. This is possible when the FindAll Listing plugin is used in conjunction with the FindAll Membership plugin, and when user registration is enabled on the site. The attacker could then modify site content, install malicious plugins, or access sensitive administrative settings.

Site administrative access.
Unauthenticated user registration.
Full site compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the FindAll Listing plugin, which requires the FindAll Membership plugin to be active, allows unauthenticated attackers to gain administrator access to WordPress sites. Identifying and securing these WordPress instances is paramount. Platform or site administrators should first confirm the presence and exposure of the affected plugins, determine business criticality, and then coordinate with the vendor for remediation or implement temporary risk reduction measures.

WordPress administrators own the issue.
Verify plugin presence and exposure first.
Coordinate vendor fix or deploy controls.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the FindAll Listing plugin for WordPress?

The FindAll Listing plugin is a component designed for WordPress sites to manage directory-style listings and business content. It functions as part of a broader ecosystem that, when paired with the FindAll Membership plugin, enables user registration and account management features for site visitors.

What does CWE-269 mean in CVE-2025-13538?

CWE-269 is a weakness class identifying Improper Privilege Management. In this CVE, it means the software fails to properly check or limit the permissions assigned to a new user. Specifically, the plugin does not verify if a registration request is authorized to request a high-level role, allowing an attacker to bypass standard security boundaries and grant themselves administrative rights.

How can an attacker trigger this vulnerability?

An attacker triggers this by interacting with the registration process on a site where both FindAll Listing and FindAll Membership plugins are active. By injecting an 'administrator' role parameter during sign-up, the attacker forces the system to elevate their account. Importantly, this bug is not triggered if the FindAll Membership plugin is inactive, as that component handles the actual registration logic.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high level of concern because the affected plugins create public-facing registration endpoints. Since WordPress sites often allow user registration over the internet, an attacker can access these forms remotely without authentication. If your site has these specific plugins enabled and allows public account creation, it is considered internet-accessible and potentially vulnerable.

How should I respond to this vulnerability?

Start by auditing your WordPress environment to confirm if both the FindAll Listing and FindAll Membership plugins are installed and active. If you identify them, prioritize checking for vendor-provided updates or security patches. If a patch is unavailable, consider disabling the registration functionality or the Membership plugin entirely until you can secure the site to prevent unauthorized administrative access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.