External risk intelligence

Pressengine WordPress Plugin Authentication Bypass Leading to Administrator Login

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-86709

This vulnerability affects a WordPress plugin login handler. WordPress sites and their login interfaces are public-facing by design in normal use to allow user access, making the vulnerable authentication mechanism directly reachable from the internet.

Authentication Bypass

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Pressengine WordPress plugin that could allow unauthorized access. This flaw enables attackers to log in as any user, including administrators, without proper authentication, potentially compromising the integrity and security of your digital assets.

Flaw lets anyone log in without a password.
Critical access issue for any user, including admins.
Confirm relevance and exposure of this plugin.

Attack Path

How an attacker could exploit the issue

An attacker can reach the Pressengine WordPress plugin's login page over the internet, as it is a public-facing component. By repeatedly submitting login attempts with incorrect credentials, the attacker can trigger a flaw in the login handler that issues a valid session, allowing them to log in as any user, including administrators. This leads to complete account takeover.

No authentication required.
Triggered by failed login attempts.
Risk: Complete account takeover.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to log in as any user on a WordPress site using the affected plugin. This is possible because the plugin incorrectly issues a session even when login authentication fails, under conditions where the plugin's login handler is accessible via the network. The primary risk is unauthorized access to user accounts and administrative functions.

User accounts and administrative access.
Unauthenticated network access to login handler.
Unauthorized account takeover and site control.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Pressengine WordPress plugin's flawed login handler, which allows unauthenticated access, likely falls under the responsibility of application owners and the platform team managing the WordPress instances. The immediate priority is to locate all deployments of the affected plugin, assess their exposure and criticality, and identify the specific business unit or owner accountable for each instance before planning remediation.

Application owners.
Verify plugin reachability and business impact.
Plan coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Pressengine WordPress plugin?

Pressengine is an add-on for WordPress websites designed to extend the platform's core capabilities. Plugins like this often handle specific features, such as custom login flows or user management, which allow site owners to modify how visitors interact with their site's authentication systems.

How does CVE-2026-86709 enable unauthorized access?

This vulnerability is classified as Improper Authentication (CWE-287). It occurs because the plugin's login handler fails to verify credentials correctly. Instead of blocking access after a failed login, the software mistakenly creates a valid session, essentially granting the requester entry as if they had provided the correct password.

What triggers this authentication flaw?

An attacker triggers this issue by interacting with the plugin's login process. The vulnerability does not require legitimate credentials; instead, it is activated when the system processes a failed login attempt. Simply navigating to the plugin's login interface and submitting incorrect information is sufficient to prompt the flawed session generation.

Why is this plugin considered high risk for internet-facing sites?

According to Halo Surface Signal, this plugin is particularly risky because its primary function—managing logins—is designed to be public-facing. Since the login handler must be accessible to users over the internet for standard operations, an attacker can reach this vulnerable component remotely without needing any special network access.

What steps should I take if I use Pressengine?

Begin by auditing your site to confirm if the Pressengine plugin is installed and active. Once identified, evaluate the criticality of the site and the data it hosts. Prioritize locating all instances across your environment so you can coordinate with your application owners to plan and implement necessary security updates or removal.

References

wpscan.com/vulnerability/4b0b16eb-c638-479b-ab65-1cead53f32a8/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.