Security Alert Summary
The Pressengine WordPress plugin through version 1.0 contains a flaw in its login handler that can issue a session even when authentication fails. This allows unauthenticated attackers to obtain an authenticated session and log in as any user, including administrators.
CVE Details
- CVE ID: CVE-2026-86709
- Affected component: The Pressengine WordPress plugin
- Affected versions: Versions up to and including 1.0
- Published: September 17, 2026 at 6:16:51 AM UTC
- Last modified: September 17, 2026 at 1:16:53 PM UTC
- CVSS v3.1 base score: 9.8
- CVSS v3.1 severity: CRITICAL
- CVSS v3.1 vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Authentication / privileges / user interaction: No authentication required; privileges required: None; user interaction: None
- Primary impact: Confidentiality: High; Integrity: High; Availability: High
- CWE / weakness: CWE-287 (Improper Authentication)
Technical Details
The plugin’s login handler issues a session even when authentication fails. Because the handler does not correctly prevent session issuance on failed authentication attempts, an unauthenticated attacker can obtain an authenticated session and access accounts without valid credentials. The CVE description identifies the login handler behavior as the root cause; no specific function names or REST endpoints are provided in the available data.
Impact is direct: an attacker who can trigger the faulty login flow can authenticate as arbitrary users, including administrative accounts. The vulnerability exists in the authentication flow logic that fails to block session creation on failed logins.
How This Could Impact Your Website
On a site with multiple WordPress users, this vulnerability could allow an external attacker to log in as internal staff or administrators without knowing their passwords. For example, a contractor or contributor account could be impersonated to access private content or account details. If an administrator account is accessed, the attacker could make changes to site settings or content consistent with that role.
Practical consequences include exposure of internal user email addresses and other account details accessible to authenticated users, and an increased risk of targeted phishing or social engineering based on harvested account information. If you are unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review of your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and other unprivileged accounts.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual logins or changes to administrative accounts.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
