Authentication Bypass Vulnerability in FindAll Membership Plugin for WordPress

CVE-2025-13539

What is CVE-2025-13539?

The FindAll Membership plugin for WordPress exposes a significant vulnerability that allows unauthenticated attackers to gain administrative access. The issue arises from improper handling of login verifications within functions designed to validate users via Facebook and Google. Attackers can exploit this flaw if they have an existing account on the website, potentially created through the plugin's temporary user feature, and access to the administrative user's email. This situation presents a serious risk, as malicious actors can easily misuse this vulnerability to take over admin accounts.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References