WordPress security changelog
HIGH CVE-2026-19125 Deferred

EthPress continues to log in after wallet-signature verification fails

An unauthenticated caller who knows a user's linked public wallet address can submit it with an arbitrary well-formed signature. In app/Login.php, verify_login() assigns a WP_Error when Signature::verify2() fails but does not return; execution falls through to Address::log_in() and wp_set_auth_cookie(). This allows impersonation of wallet-linked users, including administrators. A linked wallet is required; the external request route and parameter names are unspecified. Affected versions: <= 2.3.5.

CVE / CNA score 8.1 CVSS 3.1 · security@wordfence.com
NVD score Pending NVD has not published its own CVSS assessment.
Component
EthPress – Web3 Login
Plugin slug
ethpress
Affected
<= 2.3.5
Safe version
See mitigation notes
Published
Sep 23, 2026
Weakness
CWE-287 — Improper Authentication

This CVE was published Sep 23, 2026 and is one of 1 known issue for this plugin.

What to do

Update, patch or deactivate.

This archive could not verify a fixed version from the official author release notes reviewed on 2026-10-13. Disable the affected feature or component where practical until remediation for the deployed configuration is established. Disable wallet-based login until a matching fix is confirmed. Return immediately on signature-verification failure and issue an authentication cookie only after successful verification bound to the intended account and login challenge. Review wallet-linked administrator sessions. Official author release notes: https://wordpress.org/plugins/ethpress/#developers.

No confirmed safe version is listed. Consider a vendor-supported patch or temporarily restricting the affected functionality while you assess the risk.

Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.

Source record

Technical description

The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.

CVE / CNA vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources