Felan Framework WordPress Plugin Improper Authentication Vulnerability

A vulnerability exists in the Felan Framework plugin for WordPress, specifically in versions through 1.1.4, due to improper authentication caused by hardcoded passwords in the 'fb_ajax_login_or_register' and 'google_ajax_login_or_register' functions. This flaw allows unauthenticated attackers to log in as any existing user who registered using Facebook or Google social login and did not change their password.

Impact

Exploitation of this vulnerability allows for unauthorized login as any user who registered with Facebook or Google social login and did not change their password.

Remediation

Users can update to version 1.1.5 or a newer patched version to address this vulnerability.