Bravis User WordPress Plugin Authentication Bypass Vulnerability Allowing Account Takeover

A vulnerability allowing authentication bypass has been identified in the Bravis User plugin for WordPress, affecting all versions through 1.0.0. The issue arises because the plugin fails to properly log in users with data verified through the facebook_ajax_login_callback. This flaw enables unauthenticated attackers to log in as administrative users, provided they have an existing account on the site and access to the administrative user's email.

Impact

Exploitation of this vulnerability allows for unauthorized login as an administrative user, potentially leading to full administrative privileges on the WordPress site.

Remediation

No known patch is available. It is recommended to uninstall the affected plugin and find a replacement.