CVE-2025-10484 is an authentication bypass vulnerability (CWE-288) in the FmeAddons Registration & Login with Mobile Phone Number for WooCommerce plugin for WordPress. The vulnerability exists in all versions up to and including 1.3.1 due to insufficient verification of user identity before session authentication in the fma_lwp_set_session_php_fun() function. This allows unauthenticated attackers to authenticate as any user on the site, including administrators, without valid credentials. The CVSS 3.1 base score is 9.8, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation enables attackers to bypass authentication controls and gain full access to user accounts, including administrative accounts. This compromises site confidentiality, integrity, and availability, potentially allowing attackers to take over the site, modify content, access sensitive data, or disrupt services.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are currently available. Until a patch is released, it is recommended to disable or remove the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply official patches once available.