Search & Go Directory WordPress Theme Authentication Bypass Vulnerability Allowing Account Takeover

A vulnerability allowing authentication bypass and account takeover has been identified in the Search & Go - Directory WordPress Theme, affecting all versions through 2.7. This issue arises from inadequate user validation in the 'search_and_go_elated_check_facebook_user()' function, enabling unauthenticated attackers to access the accounts of other users, including administrators, when Facebook login is activated.

Impact

Exploitation of this vulnerability allows for unauthorized access to user accounts, including those of administrators, potentially leading to further privilege escalation.

Remediation

Users are advised to update the theme to version 2.8 or a newer patched version.