The Frontend Login and Registration Blocks plugin for WordPress (arkenon) contains an authorization bypass vulnerability (CWE-639) in the flr_blocks_user_settings_handle_ajax_callback() function. This flaw allows unauthenticated attackers to update arbitrary users' email addresses without proper identity validation. By changing an administrator's email, an attacker can trigger a password reset and gain full access to the account, resulting in privilege escalation. The vulnerability affects all versions up to and including 1.1.1. The CVSS 3.1 base score is 9.8 (Critical), reflecting network attack vector, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation enables an unauthenticated attacker to take over any user account, including administrator accounts, by changing the email address and resetting the password. This leads to full compromise of the affected WordPress site, including potential data theft, site defacement, or further malicious activity. The vulnerability poses a critical risk to the confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the plugin's AJAX endpoints if possible and monitor for suspicious activity related to user email changes and password resets. Avoid using the affected plugin versions and consider disabling the plugin temporarily if feasible.