Critical · published October 16, 2025
🚨 An improperly secured password in a WordPress plugin could let anyone log in as any user — imagine leaving the door wide open with a sign that says 'Welcome!' 🔥 Think of your website as a hotel where guests can check in using social media IDs. If the front desk never checks IDs and just lets anyone stroll in, it's like giving access to any room to an unverified visitor. An attacker could easily gain access to any existing user's account without any authentication—potentially exposing private data, changing information, or wreaking havoc on your site. With a CVSS score of 9.8, this vulnerability is absolutely devastating!
Think of your website as a hotel where guests can check in using social media IDs. If the front desk never checks IDs and just lets anyone stroll in, it's like giving access to any room to an unverified visitor. This vulnerability stems from hardcoded passwords in the 'fb_ajax_login_or_register' and 'google_ajax_login_or_register' functions of the Felan Framework plugin, allowing unauthenticated users to log in if those users haven’t changed their social login credentials.
An attacker could easily gain access to any existing user's account without any authentication—potentially exposing private data, changing information, or wreaking havoc on your site. With a CVSS score of 9.8, this vulnerability is absolutely devastating! Update the Felan Framework plugin to version 1.1.5 or higher immediately to close this security gap. Ensure users are prompted to change their passwords as an additional security measure. Regularly audit your plugins for vulnerabilities to maintain security. This is fixable! Follow these steps, and you'll protect your site in no time. 🛡️