The WP Foodbakery plugin for WordPress contains a flaw that permits an attacker to impersonate any user, including administrators, without authentication. This occurs because the plugin fails to validate a user’s identity before setting the current user and authentication cookie, resulting in improper authentication (CWE-288). Based on the description, it is inferred that the attacker can exploit the vulnerability by sending a crafted request to the foodbakery_parse_request routine, which sets the user context unconditionally.

All released versions of the Chimpstudio WP Foodbakery plugin for WordPress up to and including 4.8 are affected. Sites running any of these versions could be vulnerable to account takeover.

The CVSS score of 9.8 indicates very high severity. The EPSS score of less than 1% suggests that exploitation is currently unlikely on a wide scale, and the flaw is not catalogued in CISA’s KEV. However, because the flaw can be triggered by an unauthenticated attacker, any publicly reachable WordPress installation that has this plugin can be at risk if an attacker crafts the appropriate request. The high severity coupled with the ease of exploitation makes this a priority for remediation.