Critical · published November 27, 2025
🚨 A tiny oversight in the FindAll Membership plugin lets mischief-makers log in as admins without breaking a sweat! 🔥 Think of it like a guest at a party being handed a VIP pass without anyone checking their identity—anyone could waltz right into the exclusive lounge. This vulnerability allows unauthorized users to access admin privileges using existing user accounts, making it alarmingly easy for them to take control. An attacker could effortlessly log in as an admin, giving them the power to modify site settings, access sensitive user data, or even completely take over the website. This could lead to devastating consequences, including data breaches and loss of user trust—truly a nightmare scenario for any site owner!
Think of it like a guest at a party being handed a VIP pass without anyone checking their identity—anyone could waltz right into the exclusive lounge. This vulnerability allows unauthorized users to access admin privileges using existing user accounts, making it alarmingly easy for them to take control. The FindAll Membership plugin has an authentication bypass vulnerability caused by improper login checks for users verified through Facebook and Google. This allows unauthenticated attackers with an existing account to gain admin access without proper authentication.
An attacker could effortlessly log in as an admin, giving them the power to modify site settings, access sensitive user data, or even completely take over the website. This could lead to devastating consequences, including data breaches and loss of user trust—truly a nightmare scenario for any site owner! Immediate action is essential: update to version 1.0.5 of the FindAll Membership plugin to patch this vulnerability. Additionally, audit user accounts and consider disabling the temp user functionality to limit potential abuses. Don’t forget to monitor logs for suspicious activities! You've got this! Patch things up, and your site will be as secure as Fort Knox in no time! 🛡️