CVE-2026-19125

Received Received - Intake

Authentication Bypass in EthPress WordPress Plugin

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: Wordfence

Description

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-19125

Affected Vendors & Products

Vendor	Product	Version / Range
ethpress	web3_login	to 2.3.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

The EthPress – Web3 Login plugin for WordPress has an authentication bypass flaw in versions up to 2.3.5. The verify_login() function fails to return after detecting an invalid signature, allowing attackers to log in as any user with a linked wallet by submitting a public wallet address and a well-formed signature.

Detection Guidance

This vulnerability can be detected by checking if the EthPress plugin version is 2.3.5 or lower. Inspect the plugin files for the missing return statement in app/Login.php, specifically in the verify_login() function. No specific commands are provided in the context.

Impact Analysis

Unauthenticated attackers can gain full control of a WordPress site by logging in as any user, including administrators. This enables complete site takeover, data theft, or malicious modifications without needing valid credentials.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Organizations may face compliance breaches, legal penalties, and reputational damage.

Mitigation Strategies

Update the EthPress – Web3 Login plugin to the latest version beyond 2.3.5 immediately to patch the authentication bypass vulnerability.

Hi! I’m here to help you understand CVE-2026-19125. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70