A newly tracked flaw in the asVereinbase WordPress plugin, versions before 1.1.8, lets anyone log in as any account on the site without supplying a real password. The bug stems from how the plugin checks credentials: an empty stored value is treated as a successful match, so an unauthenticated visitor can walk straight into an administrator session. Sites running the plugin should update to 1.1.8 or later as soon as possible.
// source: nvd.nist.gov ↗