CVE-2026-19125: EthPress <= 2.3.5 - Unauthenticated Authentication Bypass
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verifylogin() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WPError to a local variable and continues executing, causing unconditional fall-through to the login block where Address::login() calls wpsetauthcookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.
Affected Software
Event History
Frequently Asked Questions
Which WordPress accounts are at risk of takeover?
Accounts with a linked wallet address are exposed. This includes administrator accounts, so compromise of a linked administrator account can result in full site takeover.
What does an attacker need to exploit the issue?
The attacker does not need to authenticate or interact with a user. They need the target user's public wallet address and an arbitrary well-formed signature; a valid signature for that wallet is not required.
How can I determine whether a specific account may be exposed?
Identify WordPress users who have linked wallet addresses in EthPress. Those accounts are potentially vulnerable in affected plugin versions, while the provided information does not indicate exposure for accounts without a linked wallet address.