This vulnerability allows an attacker to bypass authentication by exploiting an alternate path or channel in the Vitepos plugin. A compromised user can authenticate without valid credentials, gaining the same access level as a legitimate user. The core weakness is rooted in improper authentication checks (CWE-288).

The affected system is the Vitepos plugin from the vendor appsbd. All releases from the package’s initial release through version 3.1.7 are vulnerable.

The CVSS score of 7.2 indicates a high risk of unauthorized access. The EPSS score of less than 1% suggests a very low probability that this flaw has been actively exploited at the time of analysis, and it is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is via the plugin’s authentication flow; an attacker can formulate requests that take advantage of the alternate path to bypass credential validation and obtain an authenticated session. Any attacker who succeeds can then perform any actions allowed to a logged‑in user, potentially including data exfiltration or modification of WordPress site content.