CVE-2026-19125
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.
Schwachstellenklasse
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.
Quellen
- https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Address.php#L419
- https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Login.php#L46
- https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Login.php#L51
- https://plugins.trac.wordpress.org/browser/ethpress/tags/2.3.5/app/Plugin.php#L75
- https://plugins.trac.wordpress.org/changeset/3683106/ethpress/trunk/app/Login.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/267acbd7-379c-4930-aa85-3071dfcac5a5?source=cve
Finden Sie die Schwachstelle, bevor es ein Angreifer tut.
Melden Sie sich mit GitHub an und starten Sie Ihr erstes Audit in weniger als einer Minute. Für den kostenlosen Plan ist keine Kreditkarte nötig.