The Academist Membership plugin for WordPress contains a privilege‑escalation flaw where the academist_membership_check_facebook_user() function fails to verify a user’s identity before authenticating them. As a result, an unauthenticated attacker can submit a request that emits the same credentials for any target user, including administrators, effectively impersonating that user and gaining full control over the site. The weakness is categorized as CWE‑288 and can lead to complete loss of confidentiality, integrity, and discretion of the affected WordPress installation.

The affected product is Academist Membership, a WordPress plugin developed by Elated‑Themes. All releases up to and including version 1.1.6 are impacted. No specific patch version is listed in the data, but the vulnerability exists in the stated range.

The CVSS score of 9.8 indicates this flaw is a critical remote authentication bypass. The EPSS score of < 1% suggests that, while the likelihood of exploitation is currently low, the potential impact is significant enough to warrant prompt action. The vulnerability resides in the web-facing authentication endpoint of the plugin and can be exploited remotely without prior authentication, making it easy for attackers to compromise any site running a vulnerable version. The flaw is not cataloged in the CISA KEV list yet, but its high severity and the lack of active authentication make it a top‑priority risk for any affected WordPress site.