Privilege Escalation in FindAll Listing Plugin for WordPress

CVE-2025-13538

What is CVE-2025-13538?

The FindAll Listing plugin for WordPress is susceptible to a vulnerability that allows unauthenticated users to register with elevated permissions. This occurs through the 'findall_listing_user_registration_additional_params' function, which fails to limit user roles during registration. If exploited, this flaw enables attackers to gain administrative access, but it requires the FindAll Membership plugin to be active for the exploit to succeed. Users are advised to review their plugin versions and implement necessary security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References