WP Foodbakery Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability allowing account takeover has been identified in the WP Foodbakery plugin for WordPress, affecting all versions through 4.8. The issue arises because the plugin fails to properly validate a user's identity before assigning the current user and their authentication cookie. This vulnerability enables unauthenticated attackers to access the accounts of targeted users, such as administrators.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, potentially leading to further actions based on the privileges of the compromised account.

Remediation

No known patch is available. Users are advised to review the vulnerability details and consider uninstalling the affected plugin.