Authentication Bypass Vulnerability in Bravis User Plugin for WordPress

CVE-2025-5060

What is CVE-2025-5060?

The Bravis User plugin for WordPress is affected by an authentication bypass vulnerability that allows unauthenticated attackers to log in as administrative users. This flaw arises from inadequate authentication mechanisms in the plugin, particularly failing to properly validate user logins via the facebook_ajax_login_callback() function. As a result, if an attacker possesses an existing account and knows the email of an administrative user, they can exploit this vulnerability to gain unauthorized administrative access, compromising site security.

References