The SoftMarket — Digital Marketplace WordPress plugin through version 1.0.0 contains an improper authentication vulnerability (CWE-287) in one branch of its email-verification process. The plugin does not properly validate an authentication token, allowing an unauthenticated attacker to impersonate any verified user by providing only the user's ID, thereby gaining a valid session without credentials.

Successful exploitation allows an attacker to fully impersonate any verified user without authentication, leading to complete compromise of that user's session. This can result in unauthorized access to user data and actions performed with the privileges of the impersonated user. The CVSS score of 9.1 reflects the critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality and integrity.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling the plugin or restricting access to the affected functionality to trusted users only.