CVE-2025-13540 is a critical privilege escalation vulnerability in the Qode Interactive Tiare Membership WordPress plugin. The issue is caused by improper privilege management (CWE-269) in the 'tiare_membership_init_rest_api_register' function, which fails to validate or restrict the user role parameter during registration. As a result, an unauthenticated attacker can supply the 'administrator' role and gain administrator privileges on the site. This vulnerability affects all versions up to and including 1.2 and has a CVSS 3.1 base score of 9.8, indicating a critical severity with network attack vector, no required privileges or user interaction, and full confidentiality, integrity, and availability impact.

Successful exploitation allows an unauthenticated attacker to register as an administrator, gaining full control over the WordPress site. This includes the ability to modify site content, install malicious plugins or themes, access sensitive data, and potentially compromise the entire hosting environment. The vulnerability poses a critical risk to affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to disable or restrict access to the registration API endpoint used by the Tiare Membership plugin or implement web application firewall (WAF) rules to block attempts to register with elevated roles. Monitor official Qode Interactive channels for updates and apply patches promptly once released.