The Bravis User WordPress plugin allows unauthenticated attackers to bypass login authentication because the plugin fails to record a user session after processing a Facebook login callback. Based on the description, it is inferred that the attack vector is the publicly accessible Facebook login callback endpoint, which accepts the attacker‑supplied authentication data without proper session establishment. Once an attacker provides the email address of an existing administrative account, the callback accepts the authentication data and grants administrative privileges without enforcing a fresh session. This results in a full account takeover that could compromise site content, user data, and configuration.

WordPress sites that have installed the Bravis User plugin version 1.0.1 or earlier are affected. The vulnerability is specific to the Bravis-Themes packaging of the Bravis User plugin and does not impact newer releases beyond 1.0.1.

The flaw has a CVSS score of 8.1, indicating high severity, but the EPSS score is below 1% and the vulnerability is not listed in CISA’s KEV catalog, suggesting current exploitation likelihood is low. Nonetheless, the attack requires knowledge of an administrative email address and agreement to a social login, which can be obtained through phishing or data leaks. Once those prerequisites are met, an attacker can remotely gain full administrative control of the site.