The vulnerability arises because the Wurdey plugin does not verify a request signature before logging a user in. An attacker who knows an administrator’s username can craft a request that bypasses authentication and logs in as that administrator, granting full site control.

WordPress sites that use the Wurdey plugin up to version 1.0.0. The plugin is distributed by an unknown vendor, so any site that has installed that version without upgrading is affected.

The flaw allows unauthenticated users to authenticate as an administrator, which gives full control over the site. Because the attack requires only an administrator’s username and no other privileges or exploits, the likelihood of exploitation is high. No CVSS score is provided and the EPSS score is not available, but the ease of exploitation combined with the high impact means this should be treated as a critical issue. The vulnerability is not listed in the CISA KEV catalog and no official workaround is reported.