What the vulnerability does
01Description
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findall_listing_user_registration_additional_params' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can only be exploited if the FindAll Membership plugin is also activated, because user registration is in that plugin.
Explanation of Vulnerability in Simple Terms
02Summary
FindAll Listing versions 1.0.5 and earlier contain a privilege management flaw that allows unauthenticated attackers to read, modify, or delete data on the site without any user interaction. The vulnerability stems from improper access controls that fail to restrict sensitive operations. All users of affected versions should update immediately.
What an attacker can do
03Attacker Capabilities
Read, modify, or delete site data without authentication.
Potential impact on your site
04Site Impact
Attackers can access, alter, or destroy listings and data without logging in.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
November 27, 2025
CVE published
April 8, 2026
Record updated
