A high-severity authentication bypass in the AutoNetTV Relay WordPress plugin allows unauthenticated attackers to hijack administrator sessions and gain full system control.

This is an improper authentication vulnerability occurring during scheduled content-synchronization tasks. The plugin fails to verify the identity of the requester, which can lead to the exposure of administrator authentication cookies to unauthenticated attackers.

With a CVSS score of 8.1, this vulnerability presents a severe risk to organizational security. An attacker who successfully hijacks an administrator session can gain full control over the WordPress environment, leading to total data compromise, unauthorized modification of content, and potential further system exploitation.

Immediate Action: Update the AutoNetTV Relay plugin to version 3.0.14 or later to ensure proper authentication checks are enforced.

Proactive Monitoring: Review web server and WordPress authentication logs for unusual login activity or unauthorized administrative access patterns.

Compensating Controls: Utilize a WAF to block suspicious traffic and restrict access to administrative interfaces and sensitive synchronization endpoints.

Public Exploit Available: false

The potential for full administrative account takeover makes this a high-priority issue. It is imperative that administrators update to version 3.0.14 immediately to secure the environment against unauthorized access.