The vulnerability stems from hardcoded credentials embedded in the 'fb_ajax_login_or_register' and 'google_ajax_login_or_register' functions of the Felan Framework plugin. This flaw allows unauthenticated callers to authenticate as any user who registered via Facebook or Google and did not change the default password, effectively bypassing the normal authentication process. The compromised accounts could be used for data theft, privilege escalation, or to spread malicious content.

Affected parties are owners and administrators of WordPress installations running the RiceTheme Felan Framework plugin version 1.1.4 or earlier. The vulnerability exists across all installations of the plugin that have not been updated beyond this version threshold.

With a CVSS score of 9.8 the flaw is considered critical. The EPSS score is below 1 % and the vulnerability is not listed in CISA’s KEV catalog, indicating that documented exploitation is rare at present. However, the likely attack vector, based on the description, is external and requires no authentication, so an attacker can exploit the flaw simply by sending the vulnerable AJAX requests to the public site endpoints, assuming the social‑login routes are enabled. The lack of login monitoring and the use of hardcoded passwords make exploitation straightforward once the target is identified.