{"id":"CVE-2026-119258","kind":"vulnerability","aliases":["CVE-2026-119258"],"related":[],"title":"Swipe WordPress plugin: unauthenticated login as any user, including admins","description":"The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.","summary":"The Swipe WordPress plugin through version 1.4 issues a WordPress session cookie without properly checking the login request. An unauthenticated attacker can log in as an existing user, including an administrator, when that user has an active app session.","severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"swipe","fixed":[],"affected":"<= 1.4","ecosystem":"wordpress-plugin"}],"ecosystems":[],"tags":["auth-bypass","package","swipe-plugin","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Run wp plugin list --fields=name,status,version and look for swipe at version 1.4 or lower (the latest listed version is 1.4).\n- Look for wp-content/plugins/swipe on the server. A deactivated plugin is still on disk, so check inactive plugins too.\n- Check whether any admin or other user pairs their account with the Swipe mobile app.","fix":"No fixed version. WPScan lists no known fix, and the WordPress.org plugin page says the plugin was closed on October 29, 2026, pending a full review. Version 1.4 is the latest listed. Deactivate and delete the plugin until a fix is released.","status":"open","published_at":"2026-11-14T07:17:19+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","triaged_at":"2026-11-14T07:28:13+00:00","updated_at":"2026-11-14T07:29:54+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-14T07:28:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Swipe WordPress plugin: unauthenticated login as any user, including admins","impact":"high","summary":"The Swipe WordPress plugin through version 1.4 issues a WordPress session cookie without properly checking the login request. An unauthenticated attacker can log in as an existing user, including an administrator, when that user has an active app session.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","swipe-plugin"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker logs in as a site administrator and takes over the site","analyst_note":"Confirm the fixed version and the app session conditions from the NVD entry or the plugin vendor; the sources give no fix.","how_to_check":"- Check whether the Swipe plugin is installed and its version (for example, in the WordPress admin under Plugins, or `wp plugin get swipe` if WP-CLI is available)\n- Look for the plugin directory `wp-content/plugins/swipe` on the server","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Swipe WordPress plugin through version 1.4 are exposed, where users connect through the Swipe app. The sources do not say whether an attacker needs any other setting, so exposure is likely for any site with the plugin active and an admin with an active app session. Sites without the plugin can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000736,"input_tokens":4526,"output_tokens":567,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm the fixed version and the app session conditions from the NVD entry or the plugin vendor; the sources give no fix.","search":"'-119258':13A,16A '-2026':12A,15A '1.4':32B,70C 'activ':62B,102C 'admin':10A 'administr':56B,96C 'allow':84C 'app':63B,103C 'attack':46B,86C 'auth':19B 'auth-bypass':18B 'authent':74C 'bypass':20B 'check':40B 'cooki':37B,83C 'cve':11A,14A 'exist':52B,92C 'includ':9A,54B,94C 'issu':33B,79C 'log':48B,88C 'login':5A,42B,76C 'packag':21B 'plugin':3A,24B,29B,68C 'proper':39B,73C 'request':43B,77C 'session':36B,64B,82C,104C 'swipe':1A,17A,23B,27B,66C 'swipe-plugin':22B 'unauthent':4A,45B,85C 'user':8A,53B,59B,93C,99C 'version':31B 'without':38B 'wordpress':2A,25B,28B,35B,67C,81C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites with the Swipe plugin (swipepro, version 1.4 or lower) installed. An attacker with no account can get a session cookie for an existing user, including an administrator, when that user has an active session in the Swipe app. Sites without the plugin can skip it. WordPress.org shows about 10 active installs.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["swipe"],"ptokens":["swipe"],"labels":["authbypass","critical","package","swipeplugin","wordpress"],"campaign_type":null,"search_a":"'-119258':13A,16A '-2026':12A,15A 'admin':10A 'cve':11A,14A 'includ':9A 'login':5A 'plugin':3A 'swipe':1A,17A 'unauthent':4A 'user':8A 'wordpress':2A","search_b":"'1.4':32B 'activ':62B 'administr':56B 'app':63B 'attack':46B 'auth':19B 'auth-bypass':18B 'bypass':20B 'check':40B 'cooki':37B 'exist':52B 'includ':54B 'issu':33B 'log':48B 'login':42B 'packag':21B 'plugin':24B,29B 'proper':39B 'request':43B 'session':36B,64B 'swipe':23B,27B 'swipe-plugin':22B 'unauthent':45B 'user':53B,59B 'version':31B 'without':38B 'wordpress':25B,28B,35B","search_c":"'1.4':70C 'activ':102C 'administr':96C 'allow':84C 'app':103C 'attack':86C 'authent':74C 'cooki':83C 'exist':92C 'includ':94C 'issu':79C 'log':88C 'login':76C 'plugin':68C 'proper':73C 'request':77C 'session':82C,104C 'swipe':66C 'unauthent':85C 'user':93C,99C 'wordpress':67C,81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T07:17:19+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119258","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119258","severity":null,"published_at":"2026-11-14T07:17:19+00:00","modified_at":"2026-11-14T07:17:19+00:00","first_seen_at":"2026-11-14T07:27:45+00:00","fetched_at":"2026-11-14T07:27:45+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-119258:3964","url":"https://wpscan.com/vulnerability/2bb54d38-4fda-4f14-b27e-f50eca1287a3/","severity":null,"published_at":"2026-11-14T07:29:54+00:00","modified_at":"2026-11-14T07:29:54+00:00","first_seen_at":"2026-11-14T07:29:54+00:00","fetched_at":"2026-11-14T07:29:54+00:00","note":"WPScan (CNA, researcher Naoki Kawahigashi) says Swipe <= 1.4 has an unauthenticated auth bypass, CVSS 8.1, no known fix. WPScan will publish the PoC on 2027-02-10. WordPress.org closed the plugin on 2026-10-29. No exploitation reported. Fix and exact trigger conditions not read from a vendor source, so nothing is marked verified. I did not search X because there is no sign of a conversation.","cites":["https://wpscan.com/vulnerability/2bb54d38-4fda-4f14-b27e-f50eca1287a3/","https://wordpress.org/plugins/swipe/"]}],"documents":[{"id":153723,"url":"https://wpscan.com/vulnerability/2bb54d38-4fda-4f14-b27e-f50eca1287a3/","title":"Swipe <= 1.4 - Unauthenticated Authentication Bypass (WPScan)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":153724,"url":"https://wordpress.org/plugins/swipe/","title":"swipe plugin page (closed Oct 29, 2026)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}