Introduction
Attackers can gain administrator access to WordPress sites running Brave Conversion Engine (PRO) simply by exploiting a flaw in the plugin's Facebook login integration. This authentication bypass vulnerability affects all plugin versions up to and including 0.7.7, putting business-critical sites at risk of full compromise.
About Brave Conversion Engine (PRO): Brave is a commercial vendor specializing in WordPress conversion optimization tools. Their Brave Conversion Engine (PRO) plugin is used by site owners to build popups, forms, and engagement widgets, with a focus on marketing and lead generation. The plugin is widely adopted among small and medium businesses seeking to improve website conversions through user engagement features.
Technical Information
CVE-2025-7710 is caused by a logic flaw in the Brave Conversion Engine (PRO) plugin's Facebook OAuth authentication integration. When users attempt to log in via Facebook, the plugin receives OAuth tokens and user profile data from Facebook. However, the plugin does not adequately validate that the claimed WordPress user identity actually matches the authenticated Facebook account. This lack of correlation between the Facebook identity and the WordPress account enables an attacker to manipulate the authentication flow.
Specifically, an unauthenticated attacker can craft a request that presents themselves as any user, including administrators, by exploiting the insufficient identity validation in the plugin's authentication logic. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The attack is remote, requires no prior authentication, and can be performed over standard HTTP or HTTPS.
No public code snippets or proof of concept exploitation details are available at this time.
Affected Systems and Versions
- Brave Conversion Engine (PRO) WordPress plugin
- All versions up to and including 0.7.7
- Sites with Facebook authentication enabled via the plugin are vulnerable
Vendor Security History
Brave maintains an active changelog for the Conversion Engine (PRO) plugin and has responded to security reports with updates. There is no public record of similar critical authentication bypass vulnerabilities in previous versions. The presence of this flaw highlights the need for improved secure development practices, particularly around third-party authentication integrations.