Description

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T06:16:39.830Z",
  "pubdate": "2026-11-06T06:16:39.830Z",
  "executiveSummary": "A critical vulnerability in the Wurdey WordPress plugin versions up to and including 1.0.0 allows unauthenticated remote attackers to bypass site authentication and gain complete administrative access. The vulnerability originates from a lack of request signature verification during the user login handling process. Because the application fails to validate the authenticity and integrity of incoming login requests, an attacker can successfully impersonate any administrative user on the target site.\nExploitation of this vulnerability requires minimal attacker knowledge and no existing privileges; an attacker needs only to identify a valid administrator's username to execute the attack. Successful exploitation yields full administrative control over the affected WordPress installation, allowing attackers to modify site configuration, extract sensitive data, install unauthorized plugins or themes, and potentially execute arbitrary code on the underlying web server. Organizations using the affected plugin versions face severe risks to data confidentiality, system integrity, and service availability.",
  "technicalDetails": "The Wurdey WordPress plugin through version 1.0.0 provides functionality to log users into a WordPress instance via incoming external or custom requests. To ensure security, such authentication handlers must strictly validate a cryptographic signature attached to the request payload to confirm that the request originated from a trusted source and has not been tampered with in transit.\nThe root cause of this vulnerability lies in the complete absence of request signature validation prior to session creation. When processing an incoming authentication request, the plugin fails to check whether a valid signature is present or correctly computed. Instead, the login routine relies solely on user identity parameters provided within the request payload, treating unverified input as trusted identity proof.\nThe attack vector is executed over the network without requiring any prior authentication or user interaction. An unauthenticated attacker begins by discovering a valid administrator username on the target WordPress application, which can often be obtained via standard enumeration techniques. The attacker then constructs a malicious HTTP request directed at the plugin's authentication endpoint, specifying the targeted administrative username while omitting or forging the expected request signature.\nUpon receiving the payload, the vulnerable plugin code processes the request, locates the user profile corresponding to the submitted administrator username, and initiates a valid WordPress authenticated session. The response returns valid authentication cookies or session states to the attacker, completing the bypass. Once authenticated as an administrator, the attacker achieves complete compromise of the WordPress management interface, enabling unrestricted actions including database manipulation, backdoor deployment, and full site takeover."
}