Description

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T07:16:45.877Z",
  "pubdate": "2026-09-11T07:16:45.877Z",
  "executiveSummary": "The WordPress plugin teddy-bear-customize-addon, in versions through 1.0.5, contains a critical authentication bypass vulnerability.\nThe vulnerability allows an unauthenticated remote attacker to gain unauthorized access to the application by impersonating any registered user, including those with administrative privileges.\nThe root cause is a failure to verify the user's password during the authentication process, requiring only the email address of the target account to establish a session.\nThis flaw presents a severe risk as it grants an attacker full control over the affected site without requiring prior credentials, potentially leading to complete site compromise, data exfiltration, and arbitrary code execution through administrative functions.\nThe attack requires no authentication or special privileges, making it easily exploitable from any network connection accessible to the WordPress instance.",
  "technicalDetails": "The vulnerability resides within the authentication logic of the teddy-bear-customize-addon plugin. The affected component fails to implement server-side validation of user credentials against the WordPress database records during the login sequence.\nSpecifically, the plugin logic incorrectly assumes that the submission of a valid registered email address constitutes sufficient verification to authenticate the user. It neglects the critical password validation step, which is a mandatory security control in standard WordPress authentication hooks.\nAn attacker can exploit this vulnerability by submitting a crafted authentication request containing the email address of a target user, such as an administrator, to the vulnerable endpoint defined by the plugin. The server-side code processes this request by locating the account associated with the provided email and establishing a session state without triggering the necessary password verification checks.\nThe attack flow proceeds as follows: First, the attacker identifies a valid user email address, which is often discoverable via public author pages or other WordPress enumeration vectors. Second, the attacker interacts with the specific plugin-provided authentication form or API endpoint. Third, the attacker inputs the identified email address into the username/email field. Finally, the application, failing to request or validate a password, completes the authentication handshake and returns an active session token for the identified user account.\nBecause the application treats the attacker-controlled session as a legitimate login, the attacker inherits the full set of capabilities and permissions associated with the victim's account. If the target is an administrator, the attacker gains full administrative access to the WordPress dashboard. This allows for the modification of site settings, installation of malicious plugins, injection of arbitrary scripts, and potential full system compromise via server-side execution.\nThe vulnerability affects all versions of the teddy-bear-customize-addon plugin through 1.0.5. It is categorized as an authentication bypass, specifically due to improper authorization of input data. The exposure is global, as the affected function is reachable over the network and requires no pre-existing session or cryptographic token to execute."
}