Wild Apricot Login: Authentication bypass via SSO account binding (CVE-2026-93757)

CVE-2026-93757 affects the Wild Apricot Login plugin for WordPress in versions up to and including 1.0.18. The vulnerability resides in Module.php and UserSynchronizer::syncWaContact(), where the plugin incorrectly binds incoming SSO requests to existing WordPress users using an email-only lookup (get_user_by('email', ...)) if no specific contact-ID mapping exists. Because this process lacks validation (such as password checks or confirmation), an attacker can authenticate as a victim by registering a WildApricot account with the target's email address and initiating the SSO flow. This allows unauthorized access, particularly in WordPress Multisite environments where session cookies are network-global.

Impact

Successful exploitation allows an unauthenticated attacker to impersonate any WordPress user, including administrators, without requiring knowledge of the victim's credentials. In a WordPress Multisite installation, this grants administrative access across the entire network.

Recommendation

• Update the Wild Apricot Login plugin to the latest version immediately.
• Identify and audit all WordPress installations utilizing the Wild Apricot Login plugin.
• Monitor WordPress authentication logs for suspicious administrative logins occurring via SSO or unexpected account binding activity.
• Review administrative user lists on WordPress Multisite networks for unauthorized account modifications or unknown administrative users.