Freeton WP EUVD-2026-96762

Exploitation requires the target WordPress site to have the Freeton WP plugin (version ≤1.0.0) installed and active, and the attacker must know the email address of an existing user - ideally an administrator - since the flaw lets them authenticate as any user whose email they know by abusing the plugin's broken activation-code validation. No credentials, no privileges, and no user interaction are required (PR:N/UI:N), and it works against default plugin behavior. The only practical limiting factors are (1) the plugin must be installed, which narrows exposure given its small footprint, and (2) the attacker needs a valid target email, which is typically easy to obtain via WordPress author enumeration or public site content.

Multiple signals align toward genuine priority for environments running this specific plugin. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes a remote, unauthenticated, low-complexity authentication bypass with full confidentiality/integrity/availability impact (C:H/I:H/A:H), scored 9.8 - consistent with the description's claim that an attacker can log in as any user, including administrators, which equals full site takeover. POC/exploit code is reported as publicly available (via WPScan), raising practical exploitability above a theoretical high-CVSS issue. No EPSS score was provided in the input, and the CVE is NOT listed in CISA KEV, so there is no confirmation of active, widespread exploitation - the risk is real but currently 'exploitable and public' rather than 'confirmed exploited.' No SSVC decision data was supplied. One mild mitigating nuance: exploitation requires the attacker to know a valid user/admin email address, though WordPress admin emails are frequently guessable or enumerable, so this is a weak barrier. Net: for any site running Freeton WP ≤1.0.0 this is a top-priority patch/removal item; broad fleet risk is tempered only by the plugin's apparently small deployment footprint.

An unauthenticated attacker identifies the email address of an administrator (often exposed via author pages, WHOIS, or enumeration) on a WordPress site running Freeton WP ≤1.0.0. Because the plugin fails to properly validate the activation code during authentication, the attacker submits a login request for that email and is granted an authenticated administrator session without valid credentials. Public exploit code exists, lowering the skill required to carry this out.