The SoftMarket — Digital Marketplace WordPress plugin lacks proper validation of an authentication token in one branch of its email‑verification workflow, allowing an attacker who supplies only the numeric identifier of a verified user to obtain a valid session token for that user without providing any credentials. This flaw directly maps to the improper authentication weakness described in CWE‑287 and grants the attacker full access to the victim’s account to read, modify, or delete protected data, impersonate customers, or launch further attacks from within the application.

Any site running the SoftMarket — Digital Marketplace WordPress plugin version 1.0.0 or older is affected. The plugin is identified as “Unknown:SoftMarket — Digital Marketplace” in the CVE record.

The vulnerability is exploitable without prior authentication, which indicates a high likelihood of abuse, especially on publicly accessible WordPress installations. Based on the description, the attack vector is via supplying a user ID in the email‑verification flow, and the EPSS score suggests a very low but nonzero exploitation probability. The issue is not listed in the CISA KEV catalog, but the CVSS score of 9.1 confirms the vulnerability’s high severity and the potential for system‑wide damage through account takeover.