CVE-2026-93757: Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite
The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin falls back to a network-global getuserby('email', ...) lookup in Module.php to resolve a WordPress user, then UserSynchronizer::syncWaContact() binds and Controller::login() issues a session cookie via wpsetauthcookie() for that resolved user — both guarded only by issuperadmin() — without ever requiring proof of ownership of the matched WordPress account such as a password, local account-linking confirmation, inbox verification, or administrator approval. This makes it possible for attackers with custom-level WildApricot membership access to authenticate as an existing WordPress subsite administrator on a path-based Multisite network, obtaining a valid network-global authentication cookie for the victim without their credentials. Exploitation requires that the attacker control a WildApricot contact whose email address matches the target WordPress administrator's email — achievable via a public zero-fee membership application on the connected WildApricot organization — and that they complete the SSO flow on any subsite where Wild Apricot Login is active; because WordPress user identities and authentication cookies are network-global, the cookie issued on that subsite is equally valid on any other subsite where the victim user holds an administrator role.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The described attack applies to path-based WordPress Multisite networks using the affected plugin, where an existing subsite administrator has an email address that can be matched by an attacker-controlled WildApricot contact.
What does an attacker need to exploit it?
The attacker needs custom-level WildApricot membership access and control of a WildApricot contact whose email matches the target WordPress administrator. They do not need the target's WordPress password, account-linking confirmation, inbox verification, or administrator approval.
What access can successful exploitation provide?
A successful attacker can receive a valid network-global WordPress authentication cookie for the matched victim account. In the described scenario, this allows authentication as an existing WordPress subsite administrator.