Elated Membership CVE-2025-13613

Exploitation requires the Elated Membership plugin (version ≤1.2) with its Facebook/social-network login feature in use, since the flaw is in the eltdf_membership_check_facebook_user and eltdf_membership_login_user_from_social_network handlers that log a user in without properly validating the previously verified identity. The attacker needs two things: (1) an existing account on the target site - trivial to obtain because the plugin's temp-user functionality creates accounts by default; and (2) knowledge of or access to the targeted administrative user's email address, which is the value the vulnerable code trusts to select the logged-in account. The admin-email requirement is the primary limiting factor: it makes the attack targeted rather than opportunistic/automatable, and sites not using the social-login feature are not exploitable.

Signals are mixed. The input CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H, 9.8 Critical, assigned by Wordfence) describes a remote, network-reachable authentication bypass with no privileges or user interaction required, which on paper is a top-priority flaw. However, the EPSS score is low at 0.48% (40th percentile), there is no CISA KEV listing, and no public exploit code is identified at the time of analysis - so this is not confirmed to be under active or widespread exploitation. Critically, the description reveals two real prerequisites that the AC:L rating arguably understates: the attacker must possess an account on the target site (described as trivial because the plugin's 'temp user' functionality creates one by default) AND must know/control the targeted administrator's email address. The email requirement is a genuine gating condition - it makes exploitation targeted rather than mass/automatable, which is consistent with the low EPSS despite the critical CVSS. Net assessment: a serious, legitimately critical vulnerability for any site running this plugin with Facebook social login active, but realistic exploitation is targeted (attacker must know a specific admin email), so prioritize patching but treat the raw 9.8 as somewhat optimistic on complexity.

An attacker registers a throwaway account on a vulnerable WordPress site via the plugin's default temp-user functionality, then abuses the flawed Facebook social-login handlers (eltdf_membership_check_facebook_user / eltdf_membership_login_user_from_social_network) so that the site logs them in as a different user identified only by email. Supplying a known administrator's email address, the attacker is authenticated as that administrator and gains full control of the site. No public exploit code has been identified at the time of analysis, and exploitation hinges on knowing the target admin's email.