The vulnerable plugin fails to properly complete user authentication after the facebook_ajax_login_callback function verifies Facebook credentials, revealing a CWE‑288 Authentication Bypass flaw. As a result, unauthenticated users can obtain administrative access provided they can create a temporary user account and possess the target admin's email address. This flaw allows an attacker to compromise the confidentiality, integrity, and availability of the entire WordPress site, effectively bypassing the authentication system.

Case Theme User plugin for WordPress, distributed by Case-Themes, all released versions up to and including 1.0.3 are affected. Administrators enabling social login via Facebook with temporary user registration are at risk.

The CVSS score of 9.8 classifies the issue as critical, and the low EPSS score (<1%) indicates a currently low exploitation probability, yet the vulnerability remains high risk because it permits a complete break of security controls through a CWE‑288 Authentication Bypass. Attackers are likely to trigger the flaw by first creating a temporary user account and then accessing the facebook_ajax_login_callback endpoint with the email address of an administrative user.