CyberRota Analysis
AI-GeneratedThe HivePress Authentication plugin for WordPress is vulnerable to an authentication bypass that allows unauthenticated attackers to impersonate any existing user, including administrators, by exploiting the access_token parameter. This flaw arises from the plugin's failure to validate the application ID and audience when processing tokens from the Facebook Graph API. WordPress site administrators using this plugin should prioritize patching to mitigate the risk of unauthorized access to their systems.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The HivePress Authentication plugin for WordPress is vulnerable to Authentication Bypass via the access_token parameter in all versions up to, and including, 1.1.4. This is due to the authenticate_user function's Facebook authenticator resolving third-party identity by forwarding the attacker-supplied access_token to the Facebook Graph API and trusting the returned email and ID verbatim, without performing any application ID or audience validation — specifically, no /debug_token verification and no comparison of the token's app_id against the configured hp_facebook_app_id. This makes it possible for unauthenticated attackers to authenticate as any existing WordPress user, including administrators, whose email address is associated with a Facebook account for which the attacker can obtain any valid access token. Important Note: To exploit the vulnerability, the attacker must obtain the victim's access token.