CVE-2025-1671 is an authentication bypass vulnerability in the Academist Membership WordPress plugin by Elated-Themes. The issue stems from improper identity verification in the academist_membership_check_facebook_user() function, enabling attackers without any privileges to authenticate as arbitrary users, including administrators. This results in privilege escalation and potential full control over the affected WordPress site. The vulnerability affects all versions up to 1.1.6. The CVSS 3.1 base score is 9.8 (Network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability). No patch or mitigation details have been provided by the vendor or in the advisory.

Successful exploitation allows unauthenticated attackers to log in as any user, including site administrators, leading to complete compromise of the WordPress site. This includes full access to site content, configuration, and potentially other connected systems. The vulnerability poses a critical risk to affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the Academist Membership plugin or restricting access to it. Monitor for updates from Elated-Themes and apply patches promptly once available.