Technical impact
The vulnerability enables an attacker to bypass the standard authentication process by exploiting an alternate path or channel, effectively allowing authentication abuse. This means an attacker could gain unauthorized access to administrative or privileged areas of a WordPress site, potentially bypassing role–based restrictions and compromising site integrity, confidentiality, or availability.
Affected Systems
All installations of the AmentoTech Tuturn WordPress plugin with a version earlier than 3.6 are vulnerable. The issue applies to any website running WordPress that has the Tuturn plugin installed at a version less than 3.6, regardless of other security configurations.
Risk and Exploitability
The CVSS score of 9.8 categorises this vulnerability as critical, indicating a high potential impact from remote exploitation. However, the EPSS score of less than 1% suggests the likelihood of exploitation remains very low at present, and the vulnerability is not currently listed in the CISA KEV catalog. These factors mitigate the overall risk, but the vendor's recommended solution of upgrading to version 3.6 or later is still essential to eliminate the authentication bypass risk.
