Executive brief
The Pressengine WordPress plugin, used to manage website content and user access, contains a critical flaw in its login system. An attacker can bypass authentication entirely and log in as any user, including administrators, without knowing a password. This could lead to complete compromise of the WordPress site, including theft of sensitive data, defacement, or installation of malware.
Technical details
The vulnerability is an authentication bypass in the plugin's login handler (CWE-287: Broken Authentication). The root cause is that the login handler issues a valid session even when authentication fails, allowing an unauthenticated attacker to obtain authenticated access without providing valid credentials. The attack requires only network access to the WordPress login endpoint; no prior authentication or user interaction is needed. An attacker can exploit this to assume the identity of any user, including site administrators, granting full control over the WordPress installation. As of the advisory date, no official patch has been released.
Affected products
- Pressengine Pressengine through 1.0
Timeline
- 2026-09-15: disclosed
- 2026-09-17: advisory