Vulnerability · Published Mar 1, 2025 · Assigned by Wordfence
CVE-2025-1564SetSail Membership <= 1.0.3 - Authentication Bypass via Account Takeover
Critical 9.8
In plain English
A critical-severity authentication bypass in SetSail Membership from Select-Themes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 47% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 53.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The SetSail Membership plugin for WordPress is vulnerable to in all versions up to, and including, 1.0.3. This is due to the plugin not properly verifying a users identity through the social login. This makes it possible for unauthenticated attackers to log in as any user, including administrators and take over access to their account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Select-Themes | SetSail Membership | 0 – through 1.0.3 |
Weakness: CWE-288 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H