EUVD-2026-81340
GHSA-r5f2-c2h7-4jxh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Unauthenticated remote login as any user including admin with no interaction yields PR:N/UI:N/AC:L and full C/I/A via complete site takeover; scope unchanged within the WordPress instance.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.
Articles & Coverage 1
AnalysisAI
Pressengine WordPress plugin through version 1.0 contains an authentication bypass (CWE-287) that allows unauthenticated attackers to log in as any user, including administrators, because the login handler issues a session even when authentication fails. This critical vulnerability (CVSS 9.8) affects any WordPress site with the plugin installed and active, requiring no special conditions; publicly available exploit code exists. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions beyond the plugin being installed and active - remote unauthenticated exploitation works against default configurations of any WordPress site running the Pressengine plugin version ≤1.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine top-tier priority, not an inflated high-CVSS artifact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: run an immediate inventory of every WordPress instance across all environments (production, staging, development, and any externally hosted or agency-managed sites) for the Pressengine plugin at any version up to and including 1.0, using WPScan, your hosting/plugin inventory tooling, or direct filesystem review of wp-content/plugins; wherever the plugin is found, deactivate and delete it - this is the only complete mitigation because no vendor-released patch exists - and if the plugin cannot be removed immediately due to a business dependency, take the affected site offline or place it behind an authenticating reverse proxy while you escalate; in parallel, review web and application logs for anomalous or unexpected authentication events, then force password resets and rotate WordPress salts, API keys, and administrative credentials on any host where the plugin was active, treating those sites as potentially compromised. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today