Brave Conversion Engine (PRO) Authentication Bypass Vulnerability Allowing Impersonation of Users Including Administrators

A vulnerability allowing authentication bypass has been identified in the Brave Conversion Engine (PRO) plugin for WordPress, affecting all versions through 0.7.7. The issue arises because the plugin fails to properly validate a claimed identity during Facebook authentication. This flaw enables unauthenticated attackers to log in as other users, including those with administrative privileges.

Impact

Exploitation of this vulnerability allows unauthenticated attackers to bypass authentication mechanisms and log in as other users, potentially including administrators, thereby gaining unauthorized access to user accounts and associated privileges.

Remediation

Users are advised to update the Brave Conversion Engine (PRO) plugin to version 0.8.0 or a newer patched version.