CVE-2026-110955: Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

Q: What does an attacker need to exploit this issue?

An attacker only needs to know an administrator's username. No prior authentication is required.

Q: What level of access can a successful attacker obtain?

A successful attacker can authenticate as an administrator, giving them administrator-level access to the affected WordPress site.

Q: Which plugin versions are affected?

Wurdey versions through 1.0.0 are affected.

Published Nov 6, 2026

Updated

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.

Event History

Nov 6, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker only needs to know an administrator's username. No prior authentication is required.

What level of access can a successful attacker obtain?

A successful attacker can authenticate as an administrator, giving them administrator-level access to the affected WordPress site.

Which plugin versions are affected?

Wurdey versions through 1.0.0 are affected.

CVE-2026-110955: Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What level of access can a successful attacker obtain?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What level of access can a successful attacker obtain?

Which plugin versions are affected?