CVE-2025-11522 is an authentication bypass vulnerability in the Search & Go - Directory WordPress Theme caused by inadequate user validation in the search_and_go_elated_check_facebook_user() function. This weakness enables attackers to bypass authentication and gain unauthorized access to user accounts, including those with administrative privileges, when Facebook login is enabled. The vulnerability affects all versions up to and including 2.7. It is related to CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The CVSS v3.1 base score is 9.8, reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to take over any user account, including administrator accounts, leading to full compromise of the affected WordPress site. This can result in unauthorized access to sensitive data, site defacement, data manipulation, or complete loss of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to disable Facebook login functionality in the theme to prevent exploitation. Monitor official Elated-Themes communications for updates and apply patches promptly once available.