External risk intelligence

Wurdey WordPress Plugin Authentication Bypass

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-110955

This vulnerability affects a WordPress plugin. WordPress installations are frequently deployed as public-facing web applications, and authentication endpoints in such plugins are typically exposed to the internet by default, making them reachable in common real-world deployments.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical security flaw has been identified in a popular WordPress plugin that allows unauthorized individuals to gain administrator access simply by knowing a username. This issue could potentially expose sensitive data and system controls to malicious actors. Given the widespread use of WordPress for business websites, confirming whether this plugin is in use and evaluating potential exposure is important.

Attackers can take over admin accounts easily.
Impacts widely used website technology.
Confirm relevance and exposure to risks.

Attack Path

How an attacker could exploit the issue

An attacker could leverage this vulnerability by sending a specially crafted request to a WordPress site with the affected plugin installed. If the attacker knows the username of an administrator, they can bypass the authentication process without needing any prior access or credentials. This could allow them to gain full administrative control of the website.

Unauthenticated access to the WordPress site.
Unverified request signature during login.
Full administrative control of the website.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, unauthenticated attackers could potentially gain administrator access to a WordPress site by exploiting a flaw in the Wurdey plugin's request signature verification. This could allow them to perform administrative actions.

Administrator account access at risk.
Attackers can log in without credentials.
Full site control may be achieved.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical vulnerability in the Wurdey WordPress plugin allows unauthenticated attackers to gain administrator access by exploiting a missing request signature check. The first practical step is for the platform or web application owner to immediately identify all WordPress instances using this plugin, assess their exposure and business criticality, and then coordinate remediation.

Platform owners should own this issue.
Verify plugin usage and administrator account reachability.
Plan remediation during the next maintenance window.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Wurdey WordPress plugin?

Wurdey is an add-on component for WordPress websites, which is a popular content management system used to build and manage digital platforms. Plugins like this extend core site functionality, often adding custom features, tools, or interfaces. Because it operates within the WordPress environment, any security flaws in the plugin can directly impact the management and data security of the entire website.

What does CVE-2026-110955 mean for site security?

This vulnerability is classified as Improper Authentication (CWE-287). It means the plugin fails to verify the authenticity of login requests before granting access. Specifically, it skips the check of a digital signature intended to confirm the user is who they claim to be, allowing someone to log in as an administrator simply by providing a valid username.

How can an attacker trigger this vulnerability?

An attacker initiates this by sending a specifically formatted network request to the WordPress site where the plugin is active. They do not need a password or any existing account permissions. Simply knowing a valid administrator's username is sufficient to bypass the security check. Standard user browsing or requests that do not target this specific authentication endpoint will not trigger the bug.

Do I need to worry if my site is not internet-facing?

According to Halo Surface Signal, this vulnerability is most concerning for public-facing web applications. Since WordPress sites are frequently deployed on the open internet, authentication endpoints are typically reachable by anyone. If your site is strictly internal and unreachable from the internet, the risk level is lower, though the plugin remains inherently insecure until updated.

When should I take action for this vulnerability?

You should act immediately by first creating an inventory of all WordPress sites you manage to identify where the Wurdey plugin is installed. Once you have located instances of the plugin, evaluate the business criticality of those sites and plan to apply security updates or remove the plugin during your next available maintenance window to mitigate the risk of account takeover.

References

wpscan.com/vulnerability/3a1a4bb4-01ce-4b4b-8493-4b1a857d2c03/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.