CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Bravis User plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.1. This is due to the plugin not properly logging a user in with the data that was previously verified through the facebook_ajax_login_callback(). This makes it possible for unauthenticated attackers to log in as administrative users, as long as they have an existing account on the site, and access to the administrative user's email.
Explanation of Vulnerability in Simple Terms
Bravis User versions before 1.0.2 contain an authentication bypass vulnerability. An attacker can exploit this flaw to gain unauthorized access to the application without valid credentials. The vulnerability requires specific network conditions but does not require user interaction. Affected installations should update immediately to version 1.0.2 or later.
What an attacker can do
Gain unauthorized access to the application and read or modify sensitive data without valid credentials.
Potential impact on your site
Unauthorized users can access and modify data in Bravis User installations, potentially compromising user accounts and site integrity.
Conditions required to exploit
Network access to the affected application; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
