The vulnerability in RiceTheme's Felan Framework plugin allows an attacker to bypass the authentication mechanism by using an alternate path or channel. This abuse enables unauthorized possession of user accounts, granting the attacker full control over any accounts they can target. The flaw delivers a critical compromise of confidentiality, integrity, and availability for the affected WordPress site.

WordPress sites running the Felan Framework plugin from any release through version 1.1.3 are impacted. This includes all installations that have not applied a version later than 1.1.3.

The CVSS score of 9.8 reflects the high severity of the issue. The EPSS score of less than 1% indicates a very low probability of exploitation, though the flaw remains publicly documented and the plugin is widely used. It is not listed in CISA KEV. The likely attack vector is remote, web-based exploitation of the authentication bypass via an alternate endpoint, requiring only network access to the vulnerable WordPress site. No special privileges or advanced skills are required beyond identifying the vulnerable path.