Administrator account takeover via predictable login keys

Authentication bypass in WPC Shop as a Customer for WooCommerce 1.2.8 and earlier allows remote authenticated users to access administrator accounts. The generate_key function creates an insufficiently random private login key, and ajax_login() issues that key after a Subscriber-level user triggers its AJAX workflow. Subscriber-level access and successful key prediction are required; the resulting administrator session permits account takeover and privilege escalation.