The Bravis User plugin for WordPress suffers from an authentication bypass vulnerability (CWE-288) in all versions up to 1.0.1. The root cause is improper handling of user login after verification via the facebook_ajax_login_callback() function, enabling attackers with an existing site account and access to the admin user's email to bypass authentication and gain administrative access. This vulnerability is network exploitable without user interaction but requires high attack complexity due to the need for email access. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability.

Successful exploitation allows unauthenticated attackers to log in as administrative users, potentially leading to full site compromise including data theft, modification, and service disruption. The attacker must have an existing user account and access to the administrative user's email, which is a significant prerequisite but still poses a high risk given the elevated privileges gained.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider restricting access to the plugin or disabling it if possible. Monitoring for suspicious login activity and securing administrative email accounts are recommended interim measures.