WordPress Plugin Vulnerabilities

The Pressengine <= 1.0 - Unauthenticated Authentication Bypass

Description

The plugin does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.

Proof of Concept

Affects Plugins

Plugin icon
the-pressengine
No known fix

References

CVE
CVE-2026-86709

Classification

Type
AUTHBYPASS
OWASP top 10
A2: Broken Authentication and Session Management
CWE
CWE-287
CVSS
9.8 (critical)

Miscellaneous

Original Researcher
Naoki Kawahigashi
Submitter
Naoki Kawahigashi
Verified
Yes
WPVDB ID
4b0b16eb-c638-479b-ab65-1cead53f32a8

Timeline

Publicly Published
2026-09-15 (about 2 days ago)
Added
2026-09-15 (about 1 day ago)
Last Updated
2026-09-15 (about 1 day ago)

Other

Published
Title
Published
2014-09-17
Title
Custom Contact Forms < 5.1.0.4 - Unauthenticated Database Import/Export
Published
2019-09-26
Title
GiveWp < 2.5.5 - Authentication Bypass
Published
2026-07-29
Title
WP 2FA < 4.1.0 - Two-Factor Authentication Bypass via Passkeys Provider
Published
2025-03-04
Title
WP Real Estate Manager <= 2.8 - Authentication Bypass
Published
2026-09-15
Title
Login with QR <= 1.0.0 - Unauthenticated Authentication Bypass via 'autologin_code' Parameter