CVE-2025-13613

The Elated Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.2. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'eltdf_membership_check_facebook_user' and the 'eltdf_membership_login_user_from_social_network' function. This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site which can easily be created by default through the temp user functionality, and access to the administrative user's email.

• CWE-289

• https://themeforest.net/item/esmarts-a-modern-education-and-lms-theme/20987760
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f15dbce4-2e94-4735-b62b-e32d923c51ce?source=cve

Published

Dec 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13608The CC Child Pages plugin for WordPress is vulnerable to Sto…6.4
• CVE-2025-13609A vulnerability has been identified in keylime where an atta…8.2
• CVE-2025-1361The IP2Location Country Blocker plugin for WordPress is vuln…5.3
• CVE-2025-13610The RegistrationMagic – Custom Registration Forms, User Regi…6.4
• CVE-2025-13611GitLab has remediated an issue in GitLab CE/EE affecting all…5.3
• CVE-2025-13612The Album and Image Gallery plus Lightbox plugin for WordPre…6.4
• CVE-2025-13614The Cool Tag Cloud plugin for WordPress is vulnerable to Sto…8.1
• CVE-2025-13615The StreamTube Core plugin for WordPress is vulnerable to Ar…9.8
• CVE-2025-13616IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 retu…7.5
• CVE-2025-13617The Apollo13 Framework Extensions plugin for WordPress is vu…6.4
• CVE-2025-13618The Mentoring plugin for WordPress is vulnerable to privileg…9.8
• CVE-2025-13619The Flex Store Users plugin for WordPress is vulnerable to P…9.8