The Edwiser Bridge plugin for WordPress Moodle Integration contains an authentication bypass vulnerability (CWE-288) due to improper validation of the 'eb_user_email_verification_key' in the 'eb_user_email_verify' function. Because the default value of this key is empty and the code does not verify that it is non-empty, attackers can bypass authentication checks if the 'Email Verification' feature is enabled. This allows unauthenticated attackers to impersonate any user by knowing their user ID, potentially gaining administrative access. The vulnerability affects versions up to 3.0.5 and has a critical CVSS 3.1 base score of 9.8. There is no vendor advisory or patch information currently available.

Successful exploitation allows unauthenticated attackers to bypass authentication and log in as any existing user, including administrators, leading to full compromise of the affected WordPress site integrated with Moodle via Edwiser Bridge. This impacts confidentiality, integrity, and availability of the system. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the 'Email Verification' setting in the Edwiser Bridge plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.