Privilege Escalation in FindAll Listing Plugin for WordPress

CVE-2025-13538

What is CVE-2025-13538?

The FindAll Listing plugin for WordPress is susceptible to a vulnerability that allows unauthenticated users to register with elevated permissions. This occurs through the 'findall_listing_user_registration_additional_params' function, which fails to limit user roles during registration. If exploited, this flaw enables attackers to gain administrative access, but it requires the FindAll Membership plugin to be active for the exploit to succeed. Users are advised to review their plugin versions and implement necessary security measures.

References