A critical authentication vulnerability in the UsersWP WordPress plugin allows unauthenticated attackers to gain unauthorized access to any user account, including administrative accounts, by exploiting flawed social login verification.

This vulnerability is an improper privilege management flaw where the plugin fails to confirm that a social login provider has validated email ownership. This allows an unauthenticated attacker to manipulate the login process to assume the identity of any registered user.

The ability for an unauthenticated attacker to assume an administrator identity poses a catastrophic risk to the integrity and confidentiality of the entire WordPress environment. Successful exploitation could lead to full site compromise, unauthorized data exfiltration, and long-term persistence through the creation of rogue administrative accounts. With a CVSS score of 8.1, the high severity reflects the potential for total system takeover and significant operational disruption.

Immediate Action: Update the UsersWP plugin to version 1.5.10 or later immediately to incorporate the necessary email verification checks.

Proactive Monitoring: Review authentication logs for anomalous login patterns, specifically focusing on sudden administrative access from unknown or suspicious IP addresses.

Compensating Controls: If patching is not immediately feasible, consider disabling the social login functionality within the UsersWP plugin settings to prevent exploitation of this vector.

Public Exploit Available: No

Given the high CVSS score and the direct threat to administrative account integrity, organizations using the UsersWP plugin must prioritize the update to version 1.5.10. Failure to address this vulnerability effectively grants attackers the keys to the kingdom by bypassing standard authentication controls. Apply the patch immediately to maintain the security posture of your web infrastructure.