External risk intelligence

Tiare Membership Plugin Privilege Escalation Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-13540

The vulnerability exists in a WordPress plugin that handles user registration via the REST API. WordPress sites are typically public-facing, and user registration endpoints are designed to be accessible to the internet to allow new user sign-ups.

Privilege Escalation

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory highlights a critical vulnerability in the Tiare Membership plugin for WordPress, which could allow unauthenticated attackers to gain administrator access to a website by exploiting the user registration process. This issue impacts the integrity and availability of websites utilizing this plugin, potentially leading to unauthorized control and content modification.

Unauthenticated users can gain admin access.
Protects website control and content integrity.
Confirm relevance and potential exposure.

Attack Path

How an attacker could exploit the issue

An unauthenticated attacker can exploit this vulnerability by interacting with the plugin's registration process. The plugin's registration function fails to properly validate the user role requested during sign-up. This allows an attacker to assign themselves the administrator role, gaining full control over the WordPress site.

Unauthenticated access to registration.
Attacker specifies administrator role.
Full site administrative control.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could register as administrators on WordPress sites using the Tiare Membership plugin. This could lead to a complete takeover of the website.

Administrator access to websites.
Unauthenticated users can register.
Full site compromise is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Tiare Membership WordPress plugin allows unauthenticated attackers to gain administrator privileges by exploiting the user registration process. The first step for responsible teams is to identify all WordPress instances utilizing this plugin, confirm their exposure to the internet, and then determine the business criticality of each site to prioritize remediation efforts. This process should involve coordinating with the accountable application owners, who are typically responsible for the website's functionality and security.

WordPress application owners.
Verify internet-facing instances and criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Tiare Membership plugin for WordPress?

Tiare Membership is a component frequently bundled with the Tiare Wedding Vendor Directory theme. It provides WordPress sites with the necessary backend logic to manage user accounts, specifically handling registration workflows and assigning user roles within the site's membership ecosystem.

What does CVE-2025-13540 mean for security?

This vulnerability is classified as Improper Privilege Management (CWE-269). In plain English, the plugin's registration mechanism lacks a filter to restrict which roles a new user can claim. Because the system trusts the role input from the user during sign-up, it fails to prevent an attacker from escalating their own permissions to an administrator level.

How can an attacker trigger this vulnerability?

An unauthenticated user triggers the flaw by submitting a registration request through the plugin's REST API and intentionally injecting the 'administrator' role into the data payload. Notably, the vulnerability is not triggered by standard site navigation or interactions that do not utilize the registration endpoint; it specifically requires submitting a malformed registration request.

Is my site at risk according to Halo Surface Signal?

Halo Surface Signal notes that since this plugin manages registration via the public-facing WordPress REST API, any site with user registration enabled is inherently exposed to the internet. Because these endpoints are designed to be reachable to facilitate new sign-ups, the vulnerability is highly relevant for any public-facing installation.

How should I respond if I use this plugin?

Your first step is to create an inventory of all WordPress sites currently running the Tiare Membership plugin. Once identified, consult with the application owners to assess the site's exposure to the internet and its business criticality. Use this information to prioritize which sites require immediate updates or removal of the plugin to prevent unauthorized administrative access.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.