Authentication Bypass Vulnerability in Elated Membership Plugin for WordPress

CVE-2025-13613

What is CVE-2025-13613?

The Elated Membership plugin for WordPress is susceptible to an Authentication Bypass due to inadequate user verification processes in its login functionality. Specifically, the plugin fails to authenticate users who have previously verified their identity through Facebook integration, allowing unauthenticated attackers to gain access to administrative accounts. This is possible if the attacker knows the administrative user's email and has an account on the site, which can be easily created via the default temporary user functionality. As a result, this vulnerability poses a significant risk to site security, enabling potential unauthorized access to sensitive administrative functions.

References