The HivePress Authentication plugin for WordPress carries an authentication bypass in its Facebook login handler, affecting all releases up to 1.1.4. It forwards a client-supplied access token straight to Facebook's Graph API and blindly trusts whatever email and ID come back, skipping any check that the token was actually issued for the site's own app. That gap could let an attacker log in as any user and seize their account without a valid password.
// source: nvd.nist.gov ↗