A critical authentication bypass in the Zonify WordPress plugin allows unauthenticated attackers to gain unauthorized access to site owner service accounts.

This vulnerability is an information exposure flaw where the plugin fails to implement necessary capability or authentication checks. An unauthenticated attacker can exploit this to retrieve sensitive login tokens, facilitating unauthorized access to linked third-party service accounts.

The exploitation of this vulnerability leads to the compromise of sensitive credentials associated with the site owner, which can result in unauthorized access to external service accounts. With a CVSS score of 7.5, this high-severity flaw poses a significant risk of data exposure and potential secondary service hijacking, which could cause substantial reputational damage and loss of administrative control over integrated platforms.

Immediate Action: Update the Zonify WordPress plugin to version 1.0.5 or later immediately to incorporate the missing authentication checks.

Proactive Monitoring: Review web server and application access logs for unusual requests directed at plugin endpoints that typically return sensitive token data.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access to sensitive plugin-specific endpoints until the update can be applied.

Public Exploit Available: No (exploit_available: false)

Given the high severity of this vulnerability and the potential for account takeover, immediate patching is required. Administrators should verify the plugin version across all WordPress instances and apply the 1.0.5 update without delay to prevent potential credential theft.