CVE-2024-12857 is an authentication bypass vulnerability (CWE-288) in the AdForest WordPress theme by scriptsbundle, affecting all versions up to and including 5.1.8. The vulnerability arises because the theme does not properly verify a user's identity before logging them in, enabling unauthenticated attackers to authenticate as any user who has configured OTP login by phone number. This allows attackers to bypass authentication controls without credentials. The CVSS 3.1 base score is 9.8 (critical), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and full impact on confidentiality, integrity, and availability. There is no patch or official remediation information provided in the input data.

Successful exploitation allows an unauthenticated attacker to fully compromise any user account configured with OTP login by phone number, leading to complete loss of confidentiality, integrity, and availability of the affected user accounts. This can result in unauthorized access to sensitive data and administrative functions within the WordPress site using the AdForest theme.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling OTP login by phone number or restricting access to the affected theme to mitigate risk.