Wild Apricot Login CVE-2026-93757

Exploitation requires a specific stack of conditions, all drawn from the description: (1) a path-based WordPress Multisite network where user identities and auth cookies are network-global; (2) the Wild Apricot Login plugin active on at least one subsite; (3) a connected WildApricot organization that accepts public zero-fee membership applications, letting the attacker provision a custom-level contact at will; (4) the attacker-controlled WildApricot contact's email must exactly match the target WordPress administrator's email; and (5) no existing WildApricot contact-ID mapping for that email, so the code falls back to the network-global get_user_by('email', ...) lookup guarded only by is_super_admin(). Limiting factors that reduce realistic risk: the attack does not work on default single-site WordPress or subdomain-based Multisite, the attacker must know the victim admin's email, the organization must allow open/zero-fee membership, and overall attack complexity is high. No proof of password, local account-linking confirmation, inbox verification, or administrator approval is required once these conditions are met.

This is a genuine authentication-bypass issue (CWE-287) but a conditional one, and the signals are consistent rather than conflicting. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N, C:H/I:H/A:H, base 7.5) correctly reflects a network-reachable flaw with high attack complexity and low required privilege that yields full compromise of a WordPress administrator account. The high complexity is well justified by the description: the attacker needs an email collision against a specific admin, a connected WildApricot organization that accepts public zero-fee membership, the absence of an existing contact-ID mapping so the email fallback triggers, and a path-based Multisite deployment where identities and cookies are network-global. No EPSS score, no CISA KEV listing, and no public exploit were supplied, so there is no evidence of active or at-scale exploitation; the vuln.today Decision label is 'this_week', not act_now/emergency. Net: a real, high-impact administrator-takeover bug that warrants prompt remediation on affected path-based Multisite installations, but the stacked preconditions make opportunistic mass exploitation unlikely - treat it as a priority for the specific deployments that match the configuration, not as a drop-everything network-wide emergency.

An attacker submits a free, public zero-fee membership application to a WildApricot organization connected to a target WordPress site, using an email address that matches an existing WordPress subsite administrator. They then complete the Wild Apricot Login SSO flow on any subsite where the plugin is active; because no contact-ID mapping exists, the plugin falls back to an email lookup, binds to the admin account, and issues a network-global auth cookie, logging the attacker in as that administrator. No public exploit code was identified at time of analysis, and the network vector is tempered by high attack complexity (the email collision, open-membership organization, and path-based Multisite configuration must all align).