CVE-2026-14559
Received Received - Intake

Unauthenticated Login Bypass in Teddy Bear Customize Addon

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: WPScan

Description
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-14559
EUVD
EUVD-2026-75958

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
teddy-bear-customize-addon teddy-bear-customize-addon 1.0.5
teddy_bear_customize_addon plugin to 1.0.6 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass flaw in the teddy-bear-customize-addon WordPress plugin (version 1.0.5 or earlier). It allows unauthenticated attackers to log in as any registered user, including administrators, by providing only the user's email address without verifying the password.

Detection Guidance

Check if the teddy-bear-customize-addon plugin version 1.0.5 or earlier is installed. Look for unauthorized login attempts using only email addresses without passwords. Inspect WordPress logs for suspicious authentication bypass events.

Impact Analysis

Attackers can gain unauthorized access to user accounts, including admin accounts, allowing them to take control of the WordPress site. This could lead to data theft, website defacement, malware injection, or complete site takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR, HIPAA, and other regulations. It may result in data breaches, legal penalties, and loss of trust due to inadequate access controls.

Mitigation Strategies

Disable the teddy-bear-customize-addon plugin immediately. Update to the latest version if a patch becomes available. Monitor user accounts for unauthorized access and reset passwords for all users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14559. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart