The SetSail Membership plugin for WordPress fails to properly verify a user's identity through its social login feature, allowing any unauthenticated user to authenticate as any account, including administrators. This authentication failure permits an attacker to gain full control of the WordPress site, access sensitive data, modify content or settings, and potentially compromise other connected systems. The weakness matches CWE‑288, reflecting improper authentication handling.

All installations of the Select‑Themes SetSail Membership plugin up to and including version 1.0.3 are vulnerable. The affected product is the WordPress plugin sold under the SetSail Membership name.

The CVSS score of 9.8 classifies this as a critical vulnerability, indicating that remote authentication bypass could lead to complete system takeover. Although the EPSS score is below 1 % and the vulnerability is not listed in the CISA KEV catalog, based on the description it is inferred that the attack vector is through the publicly accessible social login endpoint, making exploitation straightforward for an unauthenticated attacker. Because authentication is bypassed, all credentials are effectively compromised if the attacker can choose a target account.