An unauthenticated attacker can gain access to any existing WordPress user account, including administrators, by exploiting the Login Me Now plugin’s insecure handling of transient names in the AutoLogin::listen() function. This authentication bypass gives the attacker control over the site, but the CVE entry does not describe further capabilities beyond the basic login.

The vulnerability affects the Login Me Now plugin for WordPress from Pluginly, specifically versions 1.7.2 and earlier. Only WordPress sites running these versions are impacted; newer releases are not affected.

The CVSS base score of 8.1 places the flaw in the high severity range. The EPSS score of less than 1% indicates a low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector involves sending crafted requests to the AutoLogin endpoint that include a valid transient name and value from another application. This requires the attacker to obtain or guess a transient value associated with a different software component, so exploitation is not automated. Despite the low likelihood, the potential impact of unauthorized account takeover warrants prompt remediation.