The Pressengine
Monthly
Pressengine WordPress plugin through version 1.0 contains an authentication bypass (CWE-287) that allows unauthenticated attackers to log in as any user, including administrators, because the login handler issues a session even when authentication fails. This critical vulnerability (CVSS 9.8) affects any WordPress site with the plugin installed and active, requiring no special conditions; publicly available exploit code exists. The primary limiting factor is the plugin's low deployment footprint, but where present, it is a top-priority risk.
Pressengine WordPress plugin through version 1.0 contains an authentication bypass (CWE-287) that allows unauthenticated attackers to log in as any user, including administrators, because the login handler issues a session even when authentication fails. This critical vulnerability (CVSS 9.8) affects any WordPress site with the plugin installed and active, requiring no special conditions; publicly available exploit code exists. The primary limiting factor is the plugin's low deployment footprint, but where present, it is a top-priority risk.