Vulnerability · Published Sep 17, 2026 · Assigned by WPScan
CVE-2026-86709The Pressengine <= 1.0 - Unauthenticated Authentication Bypass
Critical 9.8
In plain English
A critical-severity improper authentication in The Pressengine from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities).
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)0.6%top 49.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | The Pressengine | 0 – through 1.0 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/4b0b16eb-c638-479b-ab65-1cead53f32a8/ exploit, vdb-entry, technical-description