Introduction
Attackers can gain administrator access to WordPress sites running Brave Conversion Engine (PRO) by exploiting a flaw in the plugin's Facebook login integration. The authentication bypass affects all plugin versions up to and including 0.7.7, which puts business-critical sites at risk of full compromise.
About Brave Conversion Engine (PRO): Brave is a commercial vendor that makes WordPress conversion optimization tools. Site owners use its Brave Conversion Engine (PRO) plugin to build popups, forms, and engagement widgets for marketing and lead generation. The plugin is widely used by small and medium businesses that want to improve website conversions through user engagement features.
Technical Information
CVE-2025-7710 comes from a logic flaw in the plugin's Facebook OAuth authentication integration. When a user logs in through Facebook, the plugin receives OAuth tokens and user profile data from Facebook. It does not adequately check that the claimed WordPress user identity matches the authenticated Facebook account. Because nothing ties the Facebook identity to the WordPress account, an attacker can manipulate the authentication flow.
An unauthenticated attacker can craft a request that presents them as any user, including an administrator, and the plugin's insufficient identity validation lets it through. The vulnerability is classified as CWE-288 (Authentication Bypass Using an Alternate Path or Channel). The attack is remote, needs no prior authentication, and works over standard HTTP or HTTPS.
No public code snippets or proof-of-concept exploitation details are available at the time of writing.
Affected Systems and Versions
- Brave Conversion Engine (PRO) WordPress plugin
- All versions up to and including 0.7.7
- Sites with Facebook authentication enabled through the plugin are vulnerable
Vendor Security History
Brave keeps an active changelog for the Conversion Engine (PRO) plugin and has responded to security reports with updates. There is no public record of similar critical authentication bypass vulnerabilities in earlier versions. This flaw does show that Brave's secure development practices need to improve, particularly around third-party authentication integrations.
