WordPress Plugin Vulnerabilities

Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

Description

The plugin does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.

Proof of Concept

Affects Plugins

Plugin icon
wurdey
No known fix

References

CVE
CVE-2026-110955

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Afan
Submitter
Afan
Verified
Yes
WPVDB ID
3a1a4bb4-01ce-4b4b-8493-4b1a857d2c03

Timeline

Publicly Published
2026-11-03 (about 3 days ago)
Added
2026-11-03 (about 2 days ago)
Last Updated
2026-11-03 (about 2 days ago)

Other

Published
Title
Published
2026-10-03
Title
Deema Payment Gateway <= 1.1.2 - Unauthenticated Payment Confirmation Forgery via Unverified Success Return
Published
2026-07-17
Title
Chat On Desk < 1.0.9 - Unauthenticated Account Takeover via Password Reset OTP Bypass
Published
2026-09-17
Title
SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via bit IPN
Published
2026-02-23
Title
WeDesignTech Ultimate Booking Addon <= 1.0.1 - Authentication Bypass
Published
2025-05-06
Title
PeproDev Ultimate Profile Solutions 1.9.1 - 7.5.2 - Authentication Bypass to Account Takeover