CVE-2025-13539 is an authentication bypass vulnerability in the FindAll Membership WordPress plugin (Elated Themes) affecting all versions up to 1.0.4. The issue stems from improper login handling after user verification through 'findall_membership_check_facebook_user' and 'findall_membership_check_google_user' functions. Attackers with an existing user account and access to an administrator's email can exploit this to gain administrative access without proper authentication. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and has a critical CVSS 3.1 score of 9.8 (Network attack vector, low attack complexity, no privileges required, no user interaction, impacts confidentiality, integrity, and availability). No patch or remediation details have been provided by the vendor or other authoritative sources.

Successful exploitation allows unauthenticated attackers to bypass authentication and gain administrative privileges on affected WordPress sites using the FindAll Membership plugin. This can lead to full site compromise, including unauthorized access to sensitive data, site configuration changes, and potential further malicious activity. The vulnerability impacts confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to administrative email accounts and consider disabling or removing the FindAll Membership plugin if feasible. Monitor vendor channels for updates and apply patches promptly once available.