CVE-2025-13613
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-12-10

Last updated on: 2025-12-10

Assigner: Wordfence

Description
The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-10
Last Modified
2025-12-10
Generated
2026-05-06
AI Q&A
2025-12-10
EPSS Evaluated
2026-05-05
NVD
CVE-2025-13613
EUVD
EUVD-2025-202359
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
elated membership_plugin 1.2
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-289 The product performs authentication based on the name of a resource being accessed, or the name of the actor performing the access, but it does not properly check all possible names for that resource or actor.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in the Elated Membership plugin for WordPress allows unauthenticated attackers to bypass authentication. It occurs because the plugin does not properly log in a user after verifying them through certain social network functions. As a result, attackers who have an existing account and access to an administrative user's email can log in as that administrative user.


How can this vulnerability impact me? :

The vulnerability can allow attackers to gain unauthorized administrative access to your WordPress site. This can lead to full control over the site, including modifying content, accessing sensitive data, and potentially compromising the entire system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart