CVE-2025-1564

SetSail Membership <= 1.0.3 - Authentication Bypass via Account Takeover

CVSS 9.8 CRITICALEPSS 0.5%CWE-288

The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a users identity through the social login. This makes it possible for unauthenticated attackers to log in as any user, including administrators and take over access to their account.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

Select-Themes · SetSail Membership

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://themeforest.net/item/setsail-travel-agency-theme/22832625 https://www.wordfence.com/threat-intel/vulnerabilities/id/c2c2385e-0d1e-435a-9b82-972964084148?source=cve