CVE-2025-13613: CWE-289 Authentication Bypass by Alternate Name in Elated Themes Elated Membership
The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
AI Analysis
Technical Summary
The Elated Membership plugin for WordPress suffers from an authentication bypass vulnerability (CWE-289) due to improper handling of user login after verification through the 'eltdf_membership_check_facebook_user' and 'eltdf_membership_login_user_from_social_network' functions. This allows unauthenticated attackers who have an existing user account and access to an administrative user's email to bypass authentication and gain administrative access. The vulnerability affects all versions up to and including 1.2. No official patch or fix information is provided in the available data.
Potential Impact
Successful exploitation allows an unauthenticated attacker to log in as an administrative user, leading to full compromise of the affected WordPress site. This includes complete control over site content, user data, and potentially the underlying server environment. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to administrative email accounts and consider disabling or removing the Elated Membership plugin if possible. Monitor for updates from Elated Themes regarding a security patch.
CVE-2025-13613: CWE-289 Authentication Bypass by Alternate Name in Elated Themes Elated Membership
Description
The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Elated Membership plugin for WordPress suffers from an authentication bypass vulnerability (CWE-289) due to improper handling of user login after verification through the 'eltdf_membership_check_facebook_user' and 'eltdf_membership_login_user_from_social_network' functions. This allows unauthenticated attackers who have an existing user account and access to an administrative user's email to bypass authentication and gain administrative access. The vulnerability affects all versions up to and including 1.2. No official patch or fix information is provided in the available data.
Potential Impact
Successful exploitation allows an unauthenticated attacker to log in as an administrative user, leading to full compromise of the affected WordPress site. This includes complete control over site content, user data, and potentially the underlying server environment. The CVSS score of 9.8 reflects critical impact on confidentiality, integrity, and availability.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to administrative email accounts and consider disabling or removing the Elated Membership plugin if possible. Monitor for updates from Elated Themes regarding a security patch.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-11-24T17:18:21.090Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6938de9abc985c89a3dc30ac
Added to database: 12/10/2025, 2:44:42 AM
Last enriched: 4/9/2026, 9:35:52 AM
Last updated: 5/10/2026, 10:33:21 AM
Views: 301
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.