CVE-2025-13538
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-13538 is a critical-severity Improper Privilege Management (CWE-269) vulnerability in Themeforest (inferred from references). Its CVSS base score is 9.8 (Critical).
Operationally, ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-2 (Account Management) and AC-24 (Access Control Decisions) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-13538 is a privilege escalation vulnerability in the FindAll Listing plugin for WordPress, affecting all versions up to and including 1.0.5. The issue stems from the 'findall_listing_user_registration_additional_params' function, which fails to restrict the user roles that can be assigned during registration. Exploitation requires the FindAll Membership plugin to also be activated, as user registration functionality is provided by that plugin. The vulnerability is rated with a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-269 (Improper Privilege Management).
Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no privileges required. By supplying the 'administrator' role parameter during the registration process, an attacker gains full administrator access to the WordPress site, enabling complete control over content, users, plugins, themes, and potentially the server itself through high confidentiality, integrity, and availability impacts.
Advisories from sources including Wordfence detail the vulnerability and note its dependency on the FindAll Membership plugin, with the plugin page available on ThemeForest. No specific patch details beyond version 1.0.5 are provided in the available information, but updating the FindAll Listing plugin is implied as the primary mitigation for affected versions.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-199802
Vulnerability Data
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can register with. This makes it possible…
more
for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if the FindAll Membership plugin is also activated, because user registration is in that plugin.
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Account management directly governs assignment and tracking of privileges so proper implementation stops the weakness from being introduced.
Requiring explicit access-control decisions ensures privileges are evaluated rather than assumed or omitted.
Access enforcement applies the correct privilege checks at every request, structurally preventing unintended spheres of control.
Separation of duties constrains how privileges may be assigned, reducing the chance of overly broad actor control.
Least privilege is the direct countermeasure to improper privilege management; implementing it eliminates the root cause.
Binding security attributes to subjects/objects supplies the mechanism needed to track and enforce privileges correctly.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.15 directly mandates determining access requirements, defining/enforcing topic-specific access control policy, assigning rights/restrictions by entity/role, consistency with classification, need-to-know, privileged access restrictions, segregation, formal authorization, and dynamic rules — which stops most improper privilege management from being exploitable; bounded remainder is flawed implementation of those rules (e.g. incorrect mapping or enforcement bugs).
A.5.18 directly governs the provisioning, review, modification and timely revocation of access rights (including for role changes, termination and privilege levels), which stops most improper privilege spheres from being exploitable even if the assignment flaw exists; the bounded remainder is flaws in the underlying enforcement mechanism itself (e.g. AC-3/A.8.3)
A.8.2 directly controls the identification, allocation, review, expiry, temporary use, and separation of privileged rights per policy, which prevents most improper privilege management (CWE-269) by design; the bounded remainder is flawed tracking/checking logic inside the product's own enforcement code (the AC-3 slice of 269).
A.8.3 directly restricts access per policies (config mechanisms, per-user/group rights, isolation, dynamic techniques, auth/credential enforcement), which stops exploitation of most improper privilege management cases even if the assignment/tracking flaw remains; named remainder exists for non-access-control privilege errors (e.g. pure assignment bugs outside enforcement).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.