A critical authentication bypass vulnerability in the Firebase Authentication WordPress plugin allows unauthenticated attackers to gain full administrative access to affected websites.

The plugin suffers from improper authentication (CWE-287), where it fails to validate the email verification status within an authentication token before granting a session. This flaw allows an unauthenticated remote attacker to successfully log in as any user on the system.

This vulnerability poses a severe risk of total system compromise. By gaining unauthorized administrative access, an attacker can modify site content, extract sensitive user data, install backdoors, or perform further malicious actions within the hosting environment. While the CVSS score of 8.1 reflects a high severity, the potential for full account takeover necessitates immediate remediation to prevent complete loss of site control.

Immediate Action: Update the Firebase Authentication WordPress plugin to version 1.7.1 or higher immediately to apply the necessary verification checks.

Proactive Monitoring: Review WordPress user authentication logs for suspicious login patterns or unauthorized access attempts occurring from unknown or unexpected IP addresses.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block abnormal authentication traffic patterns, although these should only be considered a temporary measure until the plugin is patched.

Public Exploit Available: No

Given the ability of this vulnerability to grant administrative privileges to unauthenticated parties, it represents a high-risk entry point for attackers. Administrators should prioritize updating the plugin immediately to ensure that authentication tokens are properly validated against verified email records. Failure to patch this flaw leaves the entire WordPress installation vulnerable to total compromise.