Golo WordPress Theme Privilege Escalation Vulnerability Allowing Account Takeover

A vulnerability in the Golo - City Travel Guide WordPress Theme, in all versions through 1.7.0, allows for privilege escalation via account takeover. The issue arises because the theme fails to properly validate a user's identity before setting an authorization cookie. This flaw enables unauthenticated attackers to log in as any user, including administrators, if they know the user's email address.

Impact

Exploitation of this vulnerability allows for authentication bypass, enabling attackers to gain unauthorized access to user accounts, including those of administrators.

Remediation

Users are advised to update the Golo WordPress Theme to version 1.7.1 or a newer patched version.