CVE-2025-5821: Critical Authentication Bypass in WordPress Case Theme User Plugin Exploited in the Wild

CVE-2025-5821 describes a critical authentication bypass in the Case Theme User WordPress plugin, which has around 12,000 active installations and is bundled in multiple premium themes. The flaw, present in all versions up to 1.0.3, stems from the plugin’s facebook_ajax_login_callback() function and allows an unauthenticated attacker to access any account, including administrator accounts, if they know or can find the associated email address.

Exploitation began soon after public disclosure on 22 August 2025, with Wordfence reporting that the firewall has blocked over 20,900 exploit attempts as sites were targeted at scale. Attackers typically register a temporary user and then attempt to log in as an administrator using common email addresses such as owner@, office@, or sales@victim-domain[.]com, after which they delete the temporary user to erase evidence.

Top offending IPs include 2602:ffc8:2:105:216:3cff:fe96:129f, 146.70.186[.]142, and 107.175.179[.]8, each responsible for thousands of blocked requests, with attack spikes recorded on 23, 26, 30 August and 2 September; Wordfence recommends patching to 1.0.4 and auditing administrator accounts and logs immediately, according to Wordfence.