The Case Theme User WordPress plugin contains an authentication bypass vulnerability (CWE-288) due to improper handling of user login after data verification in the facebook_ajax_login_callback() function. This flaw enables unauthenticated attackers to escalate privileges to administrative level if they have an existing user account and access to the admin user's email. The vulnerability affects all versions up to 1.0.3 and carries a CVSS 3.1 score of 9.8, reflecting critical severity with network attack vector, no required privileges, and no user interaction needed. No patch or vendor advisory with remediation details is currently available.

Successful exploitation allows unauthenticated attackers to log in as administrative users, potentially leading to full site compromise including confidentiality breaches, data integrity loss, and denial of service. The attack requires the attacker to have an existing user account on the site and access to the administrative user's email, which may be feasible due to default temporary user creation functionality. This vulnerability poses a critical risk to affected WordPress sites using the Case Theme User plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should restrict access to administrative user emails and disable or remove the Case Theme User plugin if possible. Monitoring for updates from the vendor or WordPress security channels is strongly recommended. No official patch or temporary fix is currently available.