Critical · published January 17, 2026
🚨 An unauthenticated attacker can waltz right into your site with a single exploit! The WooCommerce plugin for WordPress allows attackers to impersonate any user, including admins, with zero effort. 🔥 Think of it like a restaurant where anyone can just walk in, skip the reservations, and sit at the VIP table without anyone checking their ID. That's exactly what's happening here — the plugin isn't verifying who's at the door! This vulnerability could lead to an attacker gaining full control over your site, accessing sensitive data, changing settings, or even locking out legitimate users. The consequences could be absolutely devastating, especially if an admin account is compromised! Imagine the havoc they could wreak!
Think of it like a restaurant where anyone can just walk in, skip the reservations, and sit at the VIP table without anyone checking their ID. That's exactly what's happening here — the plugin isn't verifying who's at the door! The Authentication Bypass in the WooCommerce plugin is caused by a failure to properly verify a user's identity before allowing them to authenticate through the fma_lwp_set_session_php_fun() function. This oversight allows attackers to authenticate as any user without needing a valid password.
This vulnerability could lead to an attacker gaining full control over your site, accessing sensitive data, changing settings, or even locking out legitimate users. The consequences could be absolutely devastating, especially if an admin account is compromised! Imagine the havoc they could wreak! First, patch the WooCommerce Registration & Login with Mobile Phone Number plugin to version 1.3.2 or later to close this critical hole. Next, review your user accounts to ensure no unauthorized access has occurred. Lastly, consider implementing additional security measures like two-factor authentication for added protection. You've got this! Follow these steps, and you'll secure your site in no time! 🛡️