CVE-2024-9947 is an authentication bypass vulnerability in ProfilePress Pro for WordPress, affecting all versions up to 4.11.1. The issue arises because the plugin does not properly verify the identity of the user returned by the social login token, enabling attackers who possess a target user's email to authenticate as that user without valid credentials. This can lead to full compromise of user accounts, including administrative accounts, if the targeted user has not previously linked their account to the social login provider. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required.

Successful exploitation allows unauthenticated attackers to bypass authentication and gain access to any existing user account on the affected WordPress site, including administrator accounts. This can result in full compromise of the site, including data disclosure, modification, and denial of service.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users should monitor the ProfilePress Team advisories for an official update addressing this vulnerability. Until a patch is released, consider disabling social login features or restricting access to trusted users only to reduce exposure.