WordPress Pig Plugin Auth Bypass

WordPress Pig plugin before version 4.1.0 has a serious authentication bypass vulnerability.

In the /register/password endpoint, password verification results are ignored, allowing any value to be set as the current password.

Remote attackers can exploit this by submitting a username with an incorrect current password, effectively overwriting any account credentials, including the admin account, and gaining full administrative control.