EthPress Web3 Login EUVD-2026-85703

Requires the EthPress - Web3 Login plugin (versions <= 2.3.5) installed and active on the target WordPress site, AND at least one WordPress account - ideally an administrator - must have a linked Ethereum wallet address. The attacker must know or discover that linked wallet address (often obtainable from public blockchain data or site metadata); with it, any well-formed signature is accepted regardless of validity due to the missing return in verify_login(). Limiting factors: exploitation is impossible if no users have linked wallets, and the AC:H reflects the need to identify a valid linked address; no authentication, no user interaction, and no non-default configuration beyond having wallet-linked users is required.

This is a genuine high-priority authentication bypass. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H = 8.1) is credible: an unauthenticated remote attacker can obtain a valid WordPress auth cookie for any wallet-linked account, including administrators, yielding full site takeover (C:H/I:H/A:H). The AC:H is well-justified - the attacker must know a specific wallet address that is actually linked to a target WP user, which is the only real barrier; once known, exploitation is deterministic because the flaw is a logic error (missing return) that ignores signature validity entirely. No EPSS score, no CISA KEV entry, and no public POC are present in the provided data, so this is 'no public exploit identified at time of analysis' rather than confirmed exploitation. The absence of EPSS/KEV does not lower the intrinsic risk: the root cause is trivially reproducible from the public source diff (changeset 3683106 shows the added return), so weaponization is straightforward for anyone reading the patch. Net: a real priority for any site running this plugin, not an inflated high-CVSS-low-risk case - the only mitigating factor is niche deployment and the need to know a linked wallet address (which is often publicly discoverable on-chain).

An attacker identifies the Ethereum wallet address linked to an administrator account (wallet addresses are frequently public on-chain or exposed by the site). They POST that address to the EthPress login endpoint alongside any well-formed but bogus signature; because verify_login() fails to return on signature mismatch, execution falls through to Address::log_in() and wp_set_auth_cookie() issues a valid admin session. No POC is published, but the fix diff makes the flaw trivially reproducible.