Teddy Bear Customize Addon EUVD-2026-75958

Exploitation requires only that the target WordPress site has the Teddy Bear Customize Addon plugin (version ≤1.0.5) installed and active, and that the attacker knows the email address of a registered user (administrator emails are frequently discoverable). No password, no authentication, and no user interaction are needed - the CVSS vector is AV:N/AC:L/PR:N/UI:N, so this is remote unauthenticated exploitation against any site running the vulnerable plugin. The only real limiting factor is deployment scope: the plugin is obscure, so exposure is confined to the specific sites that use it, and knowledge of a valid user email is the sole practical prerequisite.

All signals point to a genuine high priority rather than an inflated score. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H = 9.8) indicates remote, low-complexity, unauthenticated exploitation with no user interaction, which matches the description precisely - a rare case where the vector and the plain-language description agree fully. A public exploit exists per WPScan, meaning the barrier to abuse is essentially nil. The one tempering factor is prevalence: this is an obscure plugin with an 'unknown' CPE vendor, so exploitation is likely opportunistic against the specific sites that run it rather than internet-wide. EPSS is not provided in the input, and the CVE is not in CISA KEV, so there is no confirmation of active exploitation - treat it as high-likelihood-if-installed rather than confirmed in-the-wild.

An attacker learns or guesses the email address of a site administrator (often exposed in author archives, post metadata, or WHOIS) and sends a crafted request to the plugin's login handler supplying only that email. The plugin issues an authenticated session for the administrator without any password check, giving the attacker full wp-admin control to install malicious plugins/themes and achieve site takeover or code execution. A public exploit for this flow is available via WPScan.