Authentication Bypass Vulnerability in UserPro Plugin for WordPress

CVE-2023-2437

Summary

The UserPro plugin for WordPress is affected by an authentication bypass vulnerability due to inadequate user verification during Facebook logins. Attackers can exploit this flaw to gain unauthorized access, impersonating any existing user, including administrators, if they possess the user's email. The exploitation can be further enhanced by leveraging other vulnerabilities to obtain the email address required for this unauthorized login, putting user data and site security at significant risk.

References