CVE-2025-4797 is an authentication bypass vulnerability in the Golo - City Travel Guide WordPress Theme (versions up to 1.7.0). The vulnerability stems from improper validation of user identity before setting an authorization cookie, which allows unauthenticated attackers to log in as any user if they know the user's email address. This leads to privilege escalation, including administrator account takeover. The vulnerability is classified under CWE-288 (Authentication Bypass Using an Alternate Path or Channel) and carries a CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), reflecting its critical impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to bypass authentication controls and gain full access to any user account, including administrative accounts. This results in complete compromise of the affected WordPress site, enabling unauthorized data access, modification, and potential site control. The vulnerability severely impacts confidentiality, integrity, and availability of the system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected theme and consider disabling or replacing it to prevent exploitation. Monitor for updates from the vendor or theme developer regarding patches or official mitigations.