Academist Membership WordPress Plugin Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Academist Membership plugin for WordPress, affecting all versions through 1.1.6. The issue arises because the function academist_membership_check_facebook_user() fails to properly verify a user's identity before authentication. This flaw allows unauthenticated attackers to log in as any user, including administrators.

Impact

Exploitation of this vulnerability bypasses authentication, allowing attackers to gain unauthorized access to user accounts, potentially including administrative accounts.

Remediation

Users are advised to update the Academist Membership plugin to version 1.2 or a newer patched version.