CVE-2025-1638 is an authentication bypass vulnerability (CWE-288) in the Edge-Themes Alloggio Membership WordPress plugin. The issue stems from inadequate validation in the alloggio_membership_init_rest_api_facebook_login and alloggio_membership_init_rest_api_google_login functions, enabling attackers to authenticate as any user without a password. This vulnerability affects all versions up to 1.0.2 and allows remote, unauthenticated attackers to gain full control over user accounts, including administrative privileges. The CVSS 3.1 base score is 9.8, reflecting its critical impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and log in as any user, including administrators. This can lead to complete compromise of the affected WordPress site, including unauthorized access to sensitive data, modification of site content, and disruption of service.

No patch or official fix is currently available for this vulnerability. Users should avoid using the affected versions of the Alloggio Membership plugin until a vendor advisory provides remediation guidance. Monitor the Edge-Themes vendor channels for updates and apply any official fixes promptly once released. In the meantime, consider disabling the plugin or restricting access to the affected REST API endpoints if possible.