---
id: "CVE-2026-119258"
page: "https://infrastack.ai/live/CVE-2026-119258"
kind: "vulnerability"
aliases: ["CVE-2026-119258"]
title: "Swipe WordPress plugin: unauthenticated login as any user, including admins"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "swipe", "fixed": [], "affected": "<= 1.4", "ecosystem": "wordpress-plugin"}]
ecosystems: []
tags: ["auth-bypass", "package", "swipe-plugin", "wordpress"]
not_affected_if: ["plugin-not-installed"]
published_at: "2026-11-14T07:17:19+00:00"
first_seen_at: "2026-11-14T07:27:45+00:00"
updated_at: "2026-11-14T07:29:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119258", "first_seen_at": "2026-11-14T07:27:45+00:00"}, {"source": "analyst", "url": "https://wpscan.com/vulnerability/2bb54d38-4fda-4f14-b27e-f50eca1287a3/", "first_seen_at": "2026-11-14T07:29:54+00:00", "cites": ["https://wpscan.com/vulnerability/2bb54d38-4fda-4f14-b27e-f50eca1287a3/", "https://wordpress.org/plugins/swipe/"]}]
exploit_sources: []
---

# Swipe WordPress plugin: unauthenticated login as any user, including admins

Link for people: https://infrastack.ai/live/CVE-2026-119258 (this .md is for agents)

The Swipe WordPress plugin through version 1.4 issues a WordPress session cookie without properly checking the login request. An unauthenticated attacker can log in as an existing user, including an administrator, when that user has an active app session.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress-plugin:swipe affected <= 1.4 fixed no fixed version listed

## How to check

- Run wp plugin list --fields=name,status,version and look for swipe at version 1.4 or lower (the latest listed version is 1.4).
- Look for wp-content/plugins/swipe on the server. A deactivated plugin is still on disk, so check inactive plugins too.
- Check whether any admin or other user pairs their account with the Swipe mobile app.

## Fix

No fixed version. WPScan lists no known fix, and the WordPress.org plugin page says the plugin was closed on October 29, 2026, pending a full review. Version 1.4 is the latest listed. Deactivate and delete the plugin until a fix is released.

## Timeline

- 2026-11-14T07:27:45+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119258
- 2026-11-14T07:29:54+00:00 analyst https://wpscan.com/vulnerability/2bb54d38-4fda-4f14-b27e-f50eca1287a3/ — WPScan (CNA, researcher Naoki Kawahigashi) says Swipe <= 1.4 has an unauthenticated auth bypass, CVSS 8.1, no known fix. WPScan will publish the PoC on 2027-02-10. WordPress.org closed the plugin on 2026-10-29. No exploitation reported. Fix and exact trigger conditions not read from a vendor source, so nothing is marked verified. I did not search X because there is no sign of a conversation.

## Documents

- [advisory] Swipe <= 1.4 - Unauthenticated Authentication Bypass (WPScan) https://wpscan.com/vulnerability/2bb54d38-4fda-4f14-b27e-f50eca1287a3/
- [describes] swipe plugin page (closed Oct 29, 2026) https://wordpress.org/plugins/swipe/

## From the sources

The Swipe WordPress plugin through 1.4 does not properly authenticate a login request before issuing a WordPress session cookie, allowing unauthenticated attackers to log in as an existing user, including an administrator, when that user has an active app session.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_