Cpe:2.3:a:wildapricot:wild_apricot_login:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3awildapricotwild_apricot_loginwordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 05:03:16 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgWild Apricot Login: Authentication bypass via SSO account binding (CVE-2026-93757)https://feed.craftedsignal.io/briefs/2026-10-wild-apricot-plugin-bypass/Thu, 29 Oct 2026 05:03:16 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-wild-apricot-plugin-bypass/The Wild Apricot Login plugin for WordPress (<= 1.0.18) is vulnerable to authentication bypass where attackers can hijack administrative sessions by binding malicious WildApricot accounts to existing WordPress user emails via insecure SSO account mapping.CVE-2026-93757 affects the Wild Apricot Login plugin for WordPress in versions up to and including 1.0.18. The vulnerability resides in Module.php and UserSynchronizer::syncWaContact(), where the plugin incorrectly binds incoming SSO requests to existing WordPress users using an email-only lookup (get_user_by('email', ...)) if no specific contact-ID mapping exists. Because this process lacks validation (such as password checks or confirmation), an attacker can authenticate as a victim by registering a WildApricot account with the target's email address and initiating the SSO flow. This allows unauthorized access, particularly in WordPress Multisite environments where session cookies are network-global.

Impact

Successful exploitation allows an unauthenticated attacker to impersonate any WordPress user, including administrators, without requiring knowledge of the victim's credentials. In a WordPress Multisite installation, this grants administrative access across the entire network.

Recommendation

  • Update the Wild Apricot Login plugin to the latest version immediately.
  • Identify and audit all WordPress installations utilizing the Wild Apricot Login plugin.
  • Monitor WordPress authentication logs for suspicious administrative logins occurring via SSO or unexpected account binding activity.
  • Review administrative user lists on WordPress Multisite networks for unauthorized account modifications or unknown administrative users.
]]>highadvisorywordpressssoauthentication-bypasscve-2026-93757