Critical · published December 13, 2025
🚨 An unauthenticated attacker can log in as any user, even an administrator, due to a tiny flaw in the JAY Login & Register plugin for WordPress! 🔥 Think of it like a restaurant that lets anyone switch places with the customers at any table without checking IDs — one clever ruse, and they could take control of the whole dinner party! 🍽️ This vulnerability allows attackers to access sensitive user accounts, potentially leading to data theft, unauthorized changes, or complete site takeover. Imagine an intruder at the head of your table, making decisions for all — absolutely devastating!
Think of it like a restaurant that lets anyone switch places with the customers at any table without checking IDs — one clever ruse, and they could take control of the whole dinner party! 🍽️ The authentication bypass occurs in the 'jay_login_register_process_switch_back' function, where the cookie value is incorrectly validated, allowing unauthorized logins with just the user ID.
This vulnerability allows attackers to access sensitive user accounts, potentially leading to data theft, unauthorized changes, or complete site takeover. Imagine an intruder at the head of your table, making decisions for all — absolutely devastating! Update the JAY Login & Register plugin to version 2.4.02 or higher immediately, and carefully audit your user accounts for any suspicious activity. Also, consider implementing additional security measures like two-factor authentication. This is fixable! Follow these steps, and you'll bolster your defenses against this critical vulnerability! 🛡️