A flaw in the AdForest WordPress theme allows unauthenticated users to invoke the sb_login_user_with_otp_fun function without identity verification. As a result, an attacker can authenticate as any user, including administrators, thereby gaining the privileges of the target account. The vulnerability is a classic authentication bypass, classified as CWE-306, and directly compromises the integrity of user access controls.

This issue affects all installations of the scriptsbundle AdForest WordPress theme numbered 6.0.12 or earlier. The flaw is present regardless of the underlying WordPress version, so any site using the affected theme needs to be considered at risk until the theme is replaced with a corrected release.

The CVSS score of 9.8 marks this flaw as critical, meaning that a successful bypass can lead to full system compromise. The EPSS score of less than 1% suggests that exploitation is currently uncommon, and the vulnerability is not listed in CISA’s KEV catalog. While the description does not specify the exact method an attacker would use, it is reasonable to infer that the vulnerability can be exercised remotely by crafting a request to the sb_login_user_with_otp_fun endpoint, which is part of the web login process and does not require any client-side software or privileged access.