{"id":"CVE-2026-19125","aliases":["EUVD-2026-85703","GHSA-j4cg-29jc-q96r"],"status":"published","title":"EthPress \u003c= 2.3.5 - Unauthenticated Authentication Bypass","description":"The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00697,"percentile":0.53529,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-287"],"published":"2026-09-23T21:27:34Z","modified":"2026-09-24T14:42:02Z","exploits":[{"source":"pocgithub","id":"Polosss/By-Poloss..-..CVE-2026-19125","title":"Polosss/By-Poloss..-..CVE-2026-19125","date":"2026-09-23","url":"https://github.com/Polosss/By-Poloss..-..CVE-2026-19125"}],"products":[{"vendor":"lynn999","product":"ethpress – web3 login"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/267acbd7-379c-4930-aa85-3071dfcac5a5?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Login.php#L46"},{"url":"https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Login.php#L51"},{"url":"https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Plugin.php#L75"},{"url":"https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Address.php#L419"},{"url":"https://plugins.trac.wordpress.org/changeset/3683106/ethpress/trunk/app/Login.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19125"},{"url":"https://github.com/advisories/GHSA-j4cg-29jc-q96r"}],"sources":{"cve":[{"id":"CVE-2026-19125","title":"EthPress \u003c= 2.3.5 - Unauthenticated Authentication Bypass","description":"The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.","status":"published","published":"2026-09-23T21:27:34.233Z","modified":"2026-09-24T13:30:23.425Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T13:47:17.512524Z"}],"euvd":[{"id":"EUVD-2026-85703","description":"The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.","status":"published","published":"2026-09-23T21:27:34Z","modified":"2026-09-24T13:30:23Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T17:27:59.466335Z"}],"ghsa":[{"id":"GHSA-j4cg-29jc-q96r","title":"The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all...","description":"The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.","status":"published","published":"2026-09-24T00:30:25Z","modified":"2026-09-24T00:30:29Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T15:12:21.685353Z"}],"nvd":[{"id":"CVE-2026-19125","description":"The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.","status":"published","published":"2026-09-23T22:16:56.683Z","modified":"2026-09-24T14:42:02.707Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:12:51.036099Z"}]}}