---
id: "CVE-2026-93757"
kind: "vulnerability"
aliases: ["CVE-2026-93757"]
title: "WordPress Wild Apricot Login: SSO email match logs attackers in as admins"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["multisite", "package", "wild-apricot-login", "wordpress"]
not_affected_if: ["plugin-inactive", "single-site", "sso-disabled"]
published_at: "2026-10-29T04:18:43+00:00"
first_seen_at: "2026-10-29T04:41:58+00:00"
updated_at: "2026-10-29T04:43:08+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-93757", "first_seen_at": "2026-10-29T04:41:58+00:00"}]
---

# WordPress Wild Apricot Login: SSO email match logs attackers in as admins

The Wild Apricot Login WordPress plugin, up to and including 1.0.18, matches an incoming SSO login to an existing WordPress user by email address without proving the person owns that account. An attacker who controls a Wild Apricot contact with the same email as a site administrator gets a network-wide login cookie for that administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Wild Apricot Login plugin version; versions up to and including `1.0.18` are affected.
- Check whether the plugin is active on any subsite of a WordPress Multisite network.
- Check whether a Wild Apricot organization is connected and open to public membership applications.

## Fix

- Wild Apricot Login: a fixed version is not stated in the sources; unknown

## Timeline

- 2026-10-29T04:41:58+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-93757

## From the sources

The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin falls back to a network-global `get_user_by('email', ...)` lookup in `Module.php` to resolve a WordPress user, then `UserSynchronizer::syncWaContact()` binds and `Controller::login()` issues a session cookie via `wp_set_auth_cookie()` for that resolved user — both guarded only by `is_super_admin()` — without ever requiring proof of ownership of the matched WordPress account such as a password, local account-linking confirmation, inbox verification, or administrator approval. This makes it possible for attackers with custom-level WildApricot membership access to authenticate as an existing WordPress subsite administrator on a path-based Multisite network, obtaining a valid network-global authentication cookie for the victim without their credentials. Exploitation requires that the attacker control a WildApricot contact whose email address matches the target WordPress administrator's email — achievable via a public zero-fee membership application on the connected WildApricot organization — and that they complete the SSO flow on any subsite where Wild Apricot Login is active; because WordPress user identities and authentication cookies are network-global, the cookie issued on that subsite is equally valid on any other subsite where the victim user holds an administrator role.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_