The HivePress Authentication plugin for WordPress contains an authentication bypass vulnerability that allows unauthenticated attackers to hijack user accounts, including administrative accounts, by exploiting improper Facebook token validation.

The plugin fails to perform audience validation or debug token verification when processing Facebook access tokens within the authenticate_user function. This allows an unauthenticated attacker to impersonate any user associated with a compromised Facebook token.

Successful exploitation allows an attacker to gain full unauthorized access to user accounts, including accounts with administrative privileges. This poses a severe risk of complete data compromise, unauthorized modification of site content, and potential full system takeover, justifying the high severity CVSS score of 7.5.

Immediate Action: Since no specific fixed version is currently confirmed, administrators should immediately disable or remove the HivePress Authentication plugin if it is not strictly required for business operations.

Proactive Monitoring: Monitor WordPress authentication logs for unusual login patterns, specifically multiple successful logins from disparate geographical locations or unexpected administrative account activity.

Compensating Controls: Implement a Web Application Firewall (WAF) to block suspicious requests targeting the plugin authentication endpoints, though this should be considered a temporary measure until a vendor patch is applied.

Public Exploit Available: Unknown.

Given the potential for complete account takeover, organizations utilizing the HivePress Authentication plugin must prioritize the mitigation of this flaw. If the plugin is essential, monitor official vendor channels closely for the release of a security patch and apply it immediately upon availability. In the interim, evaluate the necessity of the plugin and consider deactivating it to eliminate the attack surface entirely.