{"id":"CVE-2026-110955","kind":"vulnerability","aliases":["CVE-2026-110955"],"related":[],"title":"Wurdey WordPress plugin: unsigned requests let attackers log in as admin","description":"The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.","summary":"The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in. An unauthenticated attacker who knows an administrator's username can log in as that administrator.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"wurdey","fixed":[],"affected":"<= 1.0.0","ecosystem":"wordpress"}],"ecosystems":[],"tags":["auth-bypass","package","wordpress","wurdey"],"not_affected_if":["managed-hosting","plugin-not-installed"],"how_to_check":"In WordPress admin > Plugins, look for 'Wurdey' (folder wp-content/plugins/wurdey). Any installed version, including 1.0.0, is affected. Or run: wp plugin list --name=wurdey","fix":"No fixed version known: WordPress.org lists only 1.0.0 (the affected version). Deactivate and delete the plugin; Wurdey customers should ask Wurdey support.","status":"open","published_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","triaged_at":"2026-11-06T06:42:01+00:00","updated_at":"2026-11-06T06:43:21+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T06:42:01Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Wurdey WordPress plugin: unsigned requests let attackers log in as admin","impact":"high","summary":"The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in. An unauthenticated attacker who knows an administrator's username can log in as that administrator.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wurdey"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Unauthenticated attacker logs in as administrator and takes over the site","analyst_note":"Confirm the fixed version or removal guidance for Wurdey plugin; check NVD entry CVE-2026-110955 and the plugin's WordPress.org page.","how_to_check":"- Check whether the `wurdey` plugin is installed and its version in the WordPress admin under Plugins\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Wurdey WordPress plugin version 1.0.0 or earlier are exposed, because the plugin logs users in without checking the request signature. The sources do not say whether a specific configuration is required. Sites without the plugin installed are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000667,"input_tokens":4189,"output_tokens":497,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version or removal guidance for Wurdey plugin; check NVD entry CVE-2026-110955 and the plugin's WordPress.org page.","search":"'-110955':14A,17A '-2026':13A,16A '1.0.0':30B,62C 'admin':11A 'administr':48B,56B,81C,85C 'allow':74C 'attack':7A,44B,76C 'auth':20B 'auth-bypass':19B 'authent':78C 'bypass':21B 'cve':12A,15A 'know':46B,82C 'let':6A 'log':8A,38B,52B,70C 'packag':22B 'plugin':3A,28B,60C 'request':5A,35B,67C 'signatur':36B,68C 'unauthent':43B,75C 'unsign':4A 'user':40B,72C 'usernam':50B,87C 'verifi':33B,65C 'wordpress':2A,23B,27B,59C 'wurdey':1A,18A,24B,26B,58C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Wurdey WordPress plugin version 1.0.0 or earlier are exposed, because the plugin logs users in without checking the request signature. The sources do not say whether a specific configuration is required. Sites without the plugin installed are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["wurdey"],"ptokens":["wurdey"],"labels":["authbypass","critical","package","wordpress","wurdey"],"campaign_type":null,"search_a":"'-110955':14A,17A '-2026':13A,16A 'admin':11A 'attack':7A 'cve':12A,15A 'let':6A 'log':8A 'plugin':3A 'request':5A 'unsign':4A 'wordpress':2A 'wurdey':1A,18A","search_b":"'1.0.0':30B 'administr':48B,56B 'attack':44B 'auth':20B 'auth-bypass':19B 'bypass':21B 'know':46B 'log':38B,52B 'packag':22B 'plugin':28B 'request':35B 'signatur':36B 'unauthent':43B 'user':40B 'usernam':50B 'verifi':33B 'wordpress':23B,27B 'wurdey':24B,26B","search_c":"'1.0.0':62C 'administr':81C,85C 'allow':74C 'attack':76C 'authent':78C 'know':82C 'log':70C 'plugin':60C 'request':67C 'signatur':68C 'unauthent':75C 'user':72C 'usernam':87C 'verifi':65C 'wordpress':59C 'wurdey':58C","first_public_at":"2026-11-06T06:16:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110955","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110955","severity":null,"published_at":"2026-11-06T06:16:39+00:00","modified_at":"2026-11-06T06:16:39+00:00","first_seen_at":"2026-11-06T06:40:11+00:00","fetched_at":"2026-11-06T06:40:11+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-110955:1866","url":"https://wordpress.org/plugins/wurdey/","severity":null,"published_at":"2026-11-06T06:43:21+00:00","modified_at":"2026-11-06T06:43:21+00:00","first_seen_at":"2026-11-06T06:43:21+00:00","fetched_at":"2026-11-06T06:43:21+00:00","note":"NVD page returned no text via web-cli; description from collector. WordPress.org page shows only 1.0.0 (2015, <10 installs, unmaintained), no patched release listed. No vendor advisory found; no fix to verify. Nothing marked verified.","cites":["https://wordpress.org/plugins/wurdey/","https://nvd.nist.gov/vuln/detail/CVE-2026-110955"]}],"documents":[{"id":84159,"url":"https://wordpress.org/plugins/wurdey/","title":"Wurdey – WordPress.org plugin page","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":84160,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110955","title":"NVD CVE-2026-110955","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}