The Civi WordPress theme plugin suffers from an authentication bypass vulnerability (CWE-288) due to lack of proper password randomization and user validation in specific AJAX login/register actions. This enables attackers without any privileges to authenticate as arbitrary users by supplying their email addresses. The vulnerability affects all versions up to and including 2.1.6.1. The CVSS 3.1 base score is 5.6, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability at a low level. There is no vendor advisory or patch information available at this time.

An attacker can bypass authentication controls and gain access to user accounts by exploiting the flawed login/register AJAX actions if they know the target user's email. This could lead to unauthorized access to user data and potential misuse of user privileges. The impact is rated medium due to the requirement of knowing the email and the high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable AJAX login/register endpoints if possible. Monitor for updates from the vendor or trusted security sources regarding patches or mitigations.