SetSail Membership WordPress Plugin Authentication Bypass Vulnerability Allowing Account Takeover

An authentication bypass vulnerability has been identified in the SetSail Membership plugin for WordPress, affecting all versions through 1.0.3. The vulnerability arises because the plugin fails to properly verify user identities during social login, enabling unauthenticated attackers to log in as any user, including administrators, and take over their accounts.

Impact

Exploitation of this vulnerability allows for unauthorized login as any user, with the potential to take over administrator accounts.

Remediation

Users are advised to update the SetSail Membership plugin to version 1.1 or a newer patched version.