CVE-2025-1671

Name of the Vulnerable Software and Affected Versions Academist Membership plugin for WordPress versions prior to 1.1.7

Description The issue is related to privilege escalation due to the academist membership check facebook user() function not properly verifying a user's identity before authentication. This allows unauthenticated attackers to log in as any user, including site administrators.

Recommendations For versions up to and including 1.1.6, update to a version newer than 1.1.6 to resolve the issue. As a temporary workaround, consider disabling the academist membership check facebook user() function until a patch is available.