CVE-2025-13619

Flex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation

Published Dec 20, 2025 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle::signup' and the 'fsSellerRole::add_role_seller' functions not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can be exploited with the 'fs_type' parameter if the Flex Store Seller plugin is also activated.

Analysis

Technical impact

The Flex Store Users plugin allows any visitor to register a new user account. The signup and seller‑role functions do not enforce role restrictions, so an attacker can choose the administrator role at registration time. This flaw enables an unauthenticated user to create an account with full administrator privileges, compromising the entire WordPress site. The vulnerability is mitigated only by the presence of additional access checks in future plugin releases.

Affected Systems

This flaw affects the CMSSuperHeroes Flex Store Users WordPress plugin versions 1.1.0 and earlier. The vulnerability is present in all releases up to and including 1.1.0; it is resolved in newer versions released after that point.

Risk and Exploitability

The CVSS score of 9.8 signals a critical severity. Although the EPSS score is below 1%, indicating low current exploitation probability, the flaw can be acted upon remotely without any authentication. The vulnerability is not listed in the CISA KEV catalog. An attacker can trigger the issue by accessing the registration endpoint, optionally providing the fs_type parameter if the Flex Store Seller plugin is active, and specifying the administrator role. Once exploited, the attacker gains full control of the WordPress installation.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

CMSSuperHeroes

Flex Store Users

unaffected

Version	Status	Constraints
`0`	affected	≤ 1.1.0

No data.

Vendor	Product	Versions
Wordpress	Wordpress	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade Flex Store Users plugin to the latest version that contains the role restriction fix
If an upgrade is not immediately possible, remove the Flex Store Users plugin from the site or disable it to block unauthorized role creation
Restrict the creation of new user accounts to local administrators through the WordPress user role settings or a security plugin

Generated by OpenCVE AI on April 21, 2026 at 00:40 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.369% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://themeforest.net/item/autosmart-automotive-car-dealer-wordpress-theme/20322930
https://www.wordfence.com/threat-intel/vulnerabilities/id/a2fc40ed-a6af-4069-be63-cb75e98cc98a?source=cve

History

Dec 22, 2025 9:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Dec 21, 2025 9:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wordpress Wordpress wordpress
Vendors & Products		Wordpress Wordpress wordpress

Dec 20, 2025 6:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Flex Store Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.1.0. This is due to the 'fsUserHandle::signup' and the 'fsSellerRole::add_role_seller' functions not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site. Note: The vulnerability can be exploited with the 'fs_type' parameter if the Flex Store Seller plugin is also activated.
Title		Flex Store Users <= 1.1.0 - Unauthenticated Privilege Escalation
Weaknesses		CWE-269
References		https://themeforest.net/item/autosmart-automotive-car-dealer-wordpress-theme/20322930 https://www.wordfence.com/threat-intel/vulnerabilities/id/a2fc40ed-a6af-4069-be63-cb75e98cc98a?source=cve
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`