Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-86709: Pressengine plugin lets attackers log in as any user
CVE-2026-86709 · published 25 days ago
Summary
The Pressengine add‑on for WordPress can create a login session even when the password is wrong. This means someone without credentials could sign in as any account, including an administrator. Update the plugin to the latest version or remove it if a fix is not available.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| unknown | the pressengine | <= 1.0 |
Original advisory text
The Pressengine <= 1.0 - Unauthenticated Authentication Bypass
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-287Improper Authentication
Timeline
Published17 Sep 2026
Updated11 Oct 2026
First seen17 Sep 2026
Track software like this
Free during beta