CVE-2026-84737: Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter

Q: Who can exploit this issue?

Any unauthenticated attacker who knows the email address of a WordPress user can attempt to log in as that user. This includes administrator accounts if their email addresses are known.

Q: What access could an attacker gain?

An attacker can authenticate as the targeted user rather than merely access the plugin. If the targeted account is an administrator, the attacker would obtain that administrator's WordPress access.

Q: Which plugin versions are affected?

Freeton WP versions through 1.0.0 are affected.

Published Oct 11, 2026

Updated

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.

Affected Software

1 affected component

Freeton Freeton WP<=1.0.0

Event History

Oct 11, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

Any unauthenticated attacker who knows the email address of a WordPress user can attempt to log in as that user. This includes administrator accounts if their email addresses are known.

What access could an attacker gain?

An attacker can authenticate as the targeted user rather than merely access the plugin. If the targeted account is an administrator, the attacker would obtain that administrator's WordPress access.

Which plugin versions are affected?

Freeton WP versions through 1.0.0 are affected.

CVE-2026-84737: Freeton WP <= 1.0.0 - Unauthenticated Account Takeover via 'secod' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What access could an attacker gain?

Which plugin versions are affected?