CVE-2025-5821

Name of the Vulnerable Software and Affected Versions Case Theme User plugin for WordPress versions prior to 1.0.4

Description The Case Theme User plugin for WordPress is susceptible to an authentication bypass. This issue stems from the plugin's failure to correctly log in a user with data previously verified through the facebook ajax login callback() function. This allows unauthenticated attackers to log in as administrative users if they possess an existing account on the site and have access to the administrative user's email address. This vulnerability is actively exploited in the wild, with over 1,700 vulnerable sites identified. Approximately 27,000 vulnerable sites have been found in the past year.

Recommendations Update to version 1.0.4 or later.