The Alloggio Membership plugin for WordPress contains an authentication flaw that allows unauthenticated attackers to log in as any user, including administrators, by exploiting the Facebook and Google login endpoints. The flaw is caused by the plugin not properly validating the user identity in the alloggio_membership_init_rest_api_facebook_login and alloggio_membership_init_rest_api_google_login functions. This is an authentication bypass (CWE‑288).

WordPress installations that have the Edge‑Themes Alloggio Membership plugin installed in any version up to and including 1.0.2 are vulnerable. The issue is confined to the plugin’s social login functionality and does not affect core WordPress code or other plugins.

The CVSS score of 9.8 categorizes the flaw as critical. The EPSS score of <1% indicates that exploit events are expected to be rare, but the high severity still warrants attention. Attackers could target the public Facebook or Google login API routes to authenticate as arbitrary users, bypassing all normal password requirements. The vulnerability is not listed in CISA’s KEV catalog, so no publicly known exploit code is available yet, but the nature of the flaw enables full control over a site if exploited.