CVE-2026-110955
Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass
The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.
CVSS 3.1 · 9.8 Critical
EPSS < 1%
KEV · Not listed
Vendors
Products