Description

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-17T06:16:51.327Z",
  "pubdate": "2026-09-17T06:16:51.327Z",
  "executiveSummary": "The Pressengine WordPress plugin through version 1.0 contains a critical authentication bypass vulnerability originating from improper session management within its login handler.\nThe vulnerability allows an unauthenticated remote attacker to successfully authenticate as any system user, including accounts with administrative privileges, by manipulating the login process.\nThis flaw effectively negates the security controls provided by the WordPress authentication mechanism. By failing to terminate the execution flow or invalidate session issuance upon failed credential validation, the plugin grants unauthorized access to the application.\nThe impact is total system compromise, as an attacker can gain administrative access, potentially leading to arbitrary code execution, sensitive data theft, full site takeover, and persistent backend access.\nThere are no authentication or privilege requirements for exploitation, as the flaw resides in the unauthenticated access point of the login handler. This represents a critical risk to the integrity, confidentiality, and availability of the affected WordPress site.",
  "technicalDetails": "The vulnerability exists in the Pressengine plugin's custom login handler logic implemented in versions 1.0 and below. The root cause is a failure to enforce strict conditional checks during the authentication handshake process. Specifically, the login handler logic fails to terminate the execution flow upon the detection of invalid credentials, allowing the application to proceed with session issuance despite an authentication failure.\nIn a standard WordPress environment, authentication handlers must verify submitted credentials via wp_authenticate() or equivalent mechanisms and immediately halt execution if validation fails. In the Pressengine plugin, the logic responsible for processing login requests does not ensure that the session creation routine is gated behind a successful authentication state. Consequently, the plugin's code erroneously triggers session establishment, generating valid session cookies or user tokens regardless of whether the provided password matches the target account.\nThe attack flow proceeds as follows: An unauthenticated attacker targets the vulnerable endpoint managed by the Pressengine plugin. By sending a crafted request—often merely specifying a target username without requiring a valid password—the attacker forces the plugin to invoke its flawed login logic. Because the handler fails to validate the return state of the authentication check, the server proceeds to execute the session creation function. The plugin then generates and assigns a session for the specified user, returning the necessary session identifiers to the attacker.\nThe exploit allows for complete session impersonation. Once the attacker successfully receives the session token, they can append it to their browser requests to bypass the standard WordPress login page, assuming the identity of the targeted account. Given the nature of WordPress, targeting the 'admin' or equivalent administrator-level accounts allows the attacker to access the full administrative dashboard.\nPost-exploitation, the attacker gains full control over the WordPress environment. This includes, but is not limited to, the ability to upload malicious plugins or themes containing backdoors, modify existing site content, extract user database information, and alter site configurations. The vulnerability is highly severe because it requires zero interaction from the victim and bypasses all standard password security controls, including those implemented by WordPress core or secondary authentication security plugins that rely on standard hooks."
}