---
id: "CVE-2026-110955"
page: "https://infrastack.ai/live/CVE-2026-110955"
kind: "vulnerability"
aliases: ["CVE-2026-110955"]
title: "Wurdey WordPress plugin: unsigned requests let attackers log in as admin"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "wurdey", "fixed": [], "affected": "<= 1.0.0", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["auth-bypass", "package", "wordpress", "wurdey"]
not_affected_if: ["managed-hosting", "plugin-not-installed"]
published_at: "2026-11-06T06:16:39+00:00"
first_seen_at: "2026-11-06T06:40:11+00:00"
updated_at: "2026-11-06T06:43:21+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110955", "first_seen_at": "2026-11-06T06:40:11+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-110955", "first_seen_at": "2026-11-06T06:43:21+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-110955", "https://wordpress.org/plugins/wurdey/"]}]
exploit_sources: []
---

# Wurdey WordPress plugin: unsigned requests let attackers log in as admin

Link for people: https://infrastack.ai/live/CVE-2026-110955 (this .md is for agents)

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in. An unauthenticated attacker who knows an administrator's username can log in as that administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:wurdey affected <= 1.0.0 fixed no fixed version listed

## How to check

In WordPress admin > Plugins, look for 'Wurdey' (folder wp-content/plugins/wurdey). Any installed version, including 1.0.0, is affected. Or run: wp plugin list --name=wurdey

## Fix

No fixed version known: WordPress.org lists only 1.0.0 (the affected version). Deactivate and delete the plugin; Wurdey customers should ask Wurdey support.

## Timeline

- 2026-11-06T06:40:11+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-110955
- 2026-11-06T06:43:21+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-110955 — NVD page returned no text via web-cli; description from collector. WordPress.org page shows only 1.0.0 (2015, <10 installs, unmaintained), no patched release listed. No vendor advisory found; no fix to verify. Nothing marked verified.

## Documents

- [advisory] NVD CVE-2026-110955 https://nvd.nist.gov/vuln/detail/CVE-2026-110955
- [describes] Wurdey – WordPress.org plugin page https://wordpress.org/plugins/wurdey/

## From the sources

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_