The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including admi…

Info

CVECVE-2026-86709

First seen2026-09-17 07:01 UTC

Disclosed2026-09-17 06:16 UTC

Last updated2026-09-17 07:01 UTC

Channel statusauto

Summary

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://wpscan.com/vulnerability/4b0b16eb-c638-479b-ab65-1cead53f32a8/

Timeline

2026-09-17 nvd_ingest NVD