PT-2025-9165 · WordPress · Alloggio Membership

Tonn · Published 2025-03-01 · Updated 2025-03-07 · CVE-2025-1638

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Alloggio Membership plugin for WordPress version 1.0.2 and earlier

Description The issue is related to the plugin not properly validating a user's identity through the alloggio membership init rest api facebook login and alloggio membership init rest api google login functions. This allows unauthenticated attackers to log in as any user, including administrators, without knowing a password.

Recommendations For versions up to and including 1.0.2, update to a version that fixes the authentication bypass issue. As a temporary workaround, consider disabling the alloggio membership init rest api facebook login and alloggio membership init rest api google login functions until a patch is available.

Fix

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-288

Related Identifiers

CVE-2025-1638

Affected Products

Alloggio Membership

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2025-1638 · Security Note
• https://wordfence.com/threat-intel/vulnerabilities/id/60405e54-e869-4623-892c-0821014f887b?source=cve · Note
• https://t.me/cvedetector/19218 · Telegram Post
• https://twitter.com/vFeed_IO/status/1897832549927600430 · Twitter Post
• https://themeforest.net/item/alloggio-hotel-booking-theme/26775539 · Note
• https://twitter.com/VulmonFeeds/status/1895756751099638248 · Twitter Post
• https://twitter.com/CveFindCom/status/1895761522938269864 · Twitter Post
• https://twitter.com/cracbot/status/1897603148640121124 · Twitter Post
• https://twitter.com/cybercronai/status/1896108620548321288 · Twitter Post
• https://t.me/cvenotify/112978 · Telegram Post
• https://twitter.com/vulns_space/status/1897831447664140708 · Twitter Post
• https://twitter.com/vulns_space/status/1895757673674551446 · Twitter Post
• https://t.me/latest_high_impact_cve/1891 · Telegram Post
• https://twitter.com/CVEnew/status/1895981994544415164 · Twitter Post