By supplying an Ethereum wallet address that is already linked to a target WordPress user's account, an attacker can trick the system into authenticating as that user, including accounts with administrative privileges. Once the session cookie is issued, the attacker gains full access to the WordPress site's administrative functions. The flaw was disclosed alongside a functional proof-of-concept (PoC) that automates nonce harvesting, authentication bypass, and session validation. Defenders should identify exposed WordPress instances running EthPress and prioritize upgrading to version 2.3.6 or later.

Attack Chain

1. The attacker performs an initial GET request to /wp-login.php to extract the ethpressLoginWP.loginNonce from the site's HTML.
2. The attacker crafts a request to the plugin's AJAX endpoint, supplying a target WordPress user's linked wallet address and an empty or malformed cryptographic signature.
3. The plugin's Address::log_in() function fails to properly verify the signature integrity but proceeds to resolve the wallet address to the corresponding uid in the WordPress database.
4. The plugin invokes wp_set_auth_cookie() using the resolved uid, granting the attacker a session cookie for the targeted user.
5. The attacker uses the returned session cookie to browse to the WordPress administrative dashboard.
6. The attacker leverages the session to access privileged areas, such as /wp/v2/users/me or other administrative REST API endpoints, confirming full site control.

Impact

Successful exploitation allows unauthenticated attackers to gain unauthorized administrative access to WordPress sites running the vulnerable EthPress plugin. This impact includes the potential for complete site compromise, data exfiltration, and the creation of additional persistence mechanisms, such as new administrative users or injected malicious code. The vulnerability is highly severe for any enterprise or individual using EthPress, as it leverages pre-existing wallet links to bypass standard authentication entirely.

Recommendation

• Upgrade the EthPress plugin to version 2.3.6 or newer immediately. There is no configuration-based workaround for this vulnerability.
• Audit WordPress wp_usermeta tables for the ethpress meta_key to identify which accounts have linked wallet addresses and prioritize securing these high-value targets.
• Implement the following web server-level detection to identify exploitation attempts targeting the plugin's authentication endpoint.