CVE-2025-13619

The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle::signup' and the 'fsSellerRole::add_role_seller' functions not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can be exploited with the 'fs_type' parameter if the Flex Store Seller plugin is also activated.

• CWE-269

• https://themeforest.net/item/autosmart-automotive-car-dealer-wordpress-theme/20322930
• https://www.wordfence.com/threat-intel/vulnerabilities/id/a2fc40ed-a6af-4069-be63-cb75e98cc98a?source=cve

Published

Dec 20, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-13613The Elated Membership plugin for WordPress is vulnerable to …9.8
• CVE-2025-13614The Cool Tag Cloud plugin for WordPress is vulnerable to Sto…8.1
• CVE-2025-13615The StreamTube Core plugin for WordPress is vulnerable to Ar…9.8
• CVE-2025-13616IBM DataStage on Cloud Pak for Data 5.1.2 through 5.3.0 retu…7.5
• CVE-2025-13617The Apollo13 Framework Extensions plugin for WordPress is vu…6.4
• CVE-2025-13618The Mentoring plugin for WordPress is vulnerable to privileg…9.8
• CVE-2025-1362The URL Shortener | Conversion Tracking | AB Testing | Woo…4.3
• CVE-2025-13620The Wp Social Login and Register Social Counter plugin for W…5.3
• CVE-2025-13621The dream gallery plugin for WordPress is vulnerable to Cros…6.1
• CVE-2025-13622The Jabbernotification plugin for WordPress is vulnerable to…6.1
• CVE-2025-13623The Twitscription plugin for WordPress is vulnerable to Refl…6.1
• CVE-2025-13624The Overstock Affiliate Links plugin for WordPress is vulner…6.1