Freeton Wp
Monthly
Authentication bypass in the Freeton WP WordPress plugin through version 1.0.0 lets unauthenticated attackers log in as any existing user, including administrators, using only that user's email address, because the plugin does not correctly validate the activation code used during authentication. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287) and requires no credentials and no user interaction; publicly available exploit code exists (referenced from the WPScan entry), and no CISA KEV listing indicates confirmed active exploitation. Exposure is limited to WordPress sites where the plugin is installed and active - an important qualifier given the plugin's small footprint - but for those sites the practical barrier is only knowledge of a valid account email, which is commonly obtainable through WordPress author enumeration.
Authentication bypass in the Freeton WP WordPress plugin through version 1.0.0 lets unauthenticated attackers log in as any existing user, including administrators, using only that user's email address, because the plugin does not correctly validate the activation code used during authentication. The flaw is rated 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, CWE-287) and requires no credentials and no user interaction; publicly available exploit code exists (referenced from the WPScan entry), and no CISA KEV listing indicates confirmed active exploitation. Exposure is limited to WordPress sites where the plugin is installed and active - an important qualifier given the plugin's small footprint - but for those sites the practical barrier is only knowledge of a valid account email, which is commonly obtainable through WordPress author enumeration.