WordPress Plugin Advanced Customized Prompts Unauthenticated Login Vulnerability

The advanced-customized-prompts WordPress plugin, up to version 1.0.1, has a security flaw.

This plugin does not verify passwords before issuing authenticated sessions for supplied email addresses in unauthenticated actions.

This allows unauthenticated attackers to log in as any registered user, including administrators, or create new accounts.