CVE-2026-119258: Swipe <= 1.4 - Unauthenticated Authentication Bypass
Published Nov 14, 2026
·Updated
The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.
Affected Software
0 affected components
Event History
Nov 14, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
Description
Frequently Asked Questions
1
Which users can an attacker impersonate?
An attacker can log in as an existing WordPress user, including an administrator, if that user has an active Swipe app session.
2
Does exploitation require the attacker to authenticate first?
No. The issue allows unauthenticated attackers to obtain a WordPress session cookie through an improperly authenticated login request.
3
Which plugin versions are affected?
Swipe versions through 1.4 are affected according to the available information.