Description
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.
Published: 2026-09-23
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Full Site Takeover via Authentication Bypass
Action: Immediate Patch
AI Analysis

Impact

The EthPress – Web3 Login plugin for WordPress contains a flaw in the verify_login() function where a missing return statement causes failures in signature verification to be ignored, allowing the login routine to proceed regardless of signature validity. As a result, an unauthenticated attacker can submit any user’s public wallet address combined with a well‑formed but mismatched signature to trigger wp_set_auth_cookie(), effectively logging in as that user, including administrators. This bypass enables complete takeover of the WordPress site, leading to full loss of confidentiality, integrity, and availability.

Affected Systems

EthPress – Web3 Login, version 2.3.5 and all earlier releases, distributed by lynn999 as the WordPress plugin consumer.

Risk and Exploitability

The flaw scores a CVSS of 8.1, indicating a high severity vulnerability. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. Because the bypass operates over the public login endpoint, any user with network access to the site can craft the necessary request; there are no pre‑conditions such as privileged credentials or services running locally. The exploitation path is straightforward: submit a forged signature and public wallet address to the plugin’s login routine and the system will log in without traditional authentication. The straightforward attack vector and high impact mean that the risk to affected sites is significant.

Generated by OpenCVE AI on September 23, 2026 at 22:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the EthPress plugin to the newest release (>= 2.3.6) where the verify_login logic has been corrected.
  • If an upgrade cannot be performed immediately, deactivate or completely remove the EthPress plugin to block unauthenticated login attempts via the vulnerable code path.
  • Apply or reinforce WordPress security hardening measures, such as limiting unauthenticated access to administrative endpoints and configuring a web application firewall to detect abnormal login attempts, to mitigate potential exploitation while a patch is applied.

Generated by OpenCVE AI on September 23, 2026 at 22:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 24 Sep 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Thu, 24 Sep 2026 09:45:00 +0000

Type Values Removed Values Added
First Time appeared Lynn999
Lynn999 ethpress – Web3 Login
Wordpress
Wordpress wordpress
Vendors & Products Lynn999
Lynn999 ethpress – Web3 Login
Wordpress
Wordpress wordpress

Wed, 23 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Description The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.
Title EthPress <= 2.3.5 - Unauthenticated Authentication Bypass
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Lynn999 Ethpress – Web3 Login
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-09-24T13:30:23.425Z

Reserved: 2026-08-06T15:46:55.338Z

Link: CVE-2026-19125

cve-icon Vulnrichment

Updated: 2026-09-24T13:30:19.339Z

cve-icon NVD

Status : Deferred

Published: 2026-09-23T22:16:56.683

Modified: 2026-09-24T14:42:02.707

Link: CVE-2026-19125

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-24T09:09:13Z

Weaknesses