WordPress Plugin Vulnerability Let Attackers Bypass Authentication via Social Login

A critical vulnerability in the Case Theme User WordPress plugin allows unauthenticated attackers to hijack any account on vulnerable sites, including administrators, via the social login feature. According to Wordfence Intelligence, on 31 May 2025 a report described an Authentication Bypass via Social Login affecting this plugin, installed on about 12,000 WordPress sites and bundled with themes sold through ThemeForest.

The flaw is tracked as CVE-2025-5821 and carries a CVSS score of 9.8 (Critical), affecting all versions up to and including 1.0.3. The exploit chain lets an attacker log in as any registered user by providing a known email address, using the plugin’s flawed authentication flow. Wordfence patched the plugin to version 1.0.4 on 13 August 2025, with public disclosure on 22 August and exploitation activity observed from 23 August, as their firewall began blocking malicious AJAX calls.

Since then, the firewall has blocked over 20,900 exploit attempts, with peak attack traffic occurring in late August and early September; admins are urged to upgrade to 1.0.4 immediately and verify firewall protections.