The FindAll Listing WordPress plugin contains a flaw that allows any remote user to register a new account with elevated privileges. The vulnerability exists because the findall_listing_user_registration_additional_params function accepts a role value without validating it against the list of allowed roles. If an attacker crafts a registration request carrying the role value 'administrator', the system will create an administrator account, giving the attacker full control over the site. This flaw delivers uncontestable administrator access and is active only when the FindAll Membership plugin is enabled, since registration handling occurs in that plugin.

Elated Themes' FindAll Listing plugin versions 1.0.5 and earlier are affected. The attack requires that the complementary FindAll Membership plugin be installed and activated, which is common in WordPress setups that use the FindAll business directory solution.

The flaw carries a CVSS score of 9.8, reflecting its critical severity and the breadth of impact. The EPSS score of less than 1% indicates that, as of the last update, the probability of exploitation is very low, and the vulnerability is not listed in CISA's KEV catalog. However, because an unauthenticated user can directly register an administrator account, the attack vector is straightforward and requires no pre‑existing account or complex interaction. Exploitation is contingent on the Membership plugin being turned on, but the simplicity of the registration payload and the high value of the target role make the process highly viable for motivated adversaries.