Security Alert Summary
The EthPress – Web3 Login plugin for WordPress (all versions up to and including 2.3.5) contains an authentication bypass that can allow unauthenticated attackers to log in as any WordPress user with a linked wallet address. The issue stems from a missing return in the signature verification failure path, which can result in unconditional authentication and potential site takeover for affected sites.
CVE Details
- CVE ID: CVE-2026-19125
- Affected plugin / component: EthPress – Web3 Login (vendor: lynn999)
- Affected versions: All versions up to and including 2.3.5
- Published: September 23, 2026 at 10:16:56 PM UTC
- Last modified: September 24, 2026 at 2:42:02 PM UTC
- CVSS v3.1: Base Score 8.1, Severity HIGH; Vector:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: Privileges Required: NONE; User Interaction: NONE; Attack Complexity: HIGH
- Primary impact: Confidentiality: HIGH; Integrity: HIGH; Availability: HIGH
- CWE / weakness ID: CWE-287
Technical Details
The plugin’s verify_login() function (in app/Login.php) fails to stop execution when signature verification fails. When Signature::verify2() reports a mismatch, the code assigns a WP_Error to a local variable but does not return or stop execution. This results in an unconditional fall-through to the login block where Address::log_in() invokes wp_set_auth_cookie() regardless of signature validity. An attacker can submit a legitimate-looking signature (not necessarily matching the private key) along with a target user’s public wallet address and be authenticated as that user if the user has a linked wallet address, including administrator accounts. The description indicates this behavior enables full site takeover on affected installations.
How This Could Impact Your Website
In a typical small- to medium-sized WordPress site, multiple people may have accounts and linked wallet addresses: the site owner, internal staff editors, and external contributors or contractors. If your site uses EthPress and staff or contractors have linked wallet addresses, an unauthenticated attacker could log in as those users without valid credentials. Practical consequences include exposure of internal user email addresses, unauthorized posting or editing of content, and elevated risk of targeted phishing or social engineering against staff whose accounts are impersonated. Site administrators could be impersonated, which may allow configuration changes or installation of malicious code consistent with the described impact.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and editor privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and authentication logs for unusual behavior or unexpected logins.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Address.php#L419
- https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Login.php#L46
- https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Login.php#L51
- https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Plugin.php#L75
- https://plugins.trac.wordpress.org/changeset/3683106/ethpress/trunk/app/Login.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/267acbd7-379c-4930-aa85-3071dfcac5a5?source=cve
