Authentication Bypass Vulnerability in FindAll Membership Plugin for WordPress

CVE-2025-13539

What is CVE-2025-13539?

The FindAll Membership plugin for WordPress exposes a significant vulnerability that allows unauthenticated attackers to gain administrative access. The issue arises from improper handling of login verifications within functions designed to validate users via Facebook and Google. Attackers can exploit this flaw if they have an existing account on the website, potentially created through the plugin's temporary user feature, and access to the administrative user's email. This situation presents a serious risk, as malicious actors can easily misuse this vulnerability to take over admin accounts.

References