CVE-2026-110955: Wurdey Authentication Bypass
A critical authentication bypass has been published for the Wurdey WordPress plugin. Tracked as CVE-2026-110955 (CVSS 9.8, Critical), the plugin does not verify a request signature before logging a user in. An unauthenticated attacker who knows only an administrator's username can authenticate as that administrator.
Vulnerability Overview
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-110955 |
| CVSS Score | 9.8 (Critical) |
| Affected Software | Wurdey WordPress plugin, version 1.0.0 and earlier |
| Attack Vector | Network, unauthenticated |
| Published | November 6, 2026 |
Impact
Administrator access to WordPress allows installing plugins or editing theme files, which typically leads to remote code execution on the host, plus access to site content, user data and stored credentials. Administrator usernames are often easy to discover, for example through author archives or the REST users endpoint.
Remediation
- Check whether Wurdey is installed on any WordPress site you manage.
- Deactivate and remove the plugin until the vendor ships a fixed release. No patched version was listed in the NVD entry at publication time.
- Review administrator accounts and recent logins for unexpected activity, and rotate administrator passwords and sessions if the plugin was exposed.
- Check for unfamiliar plugins, modified theme files and new administrator users.
- Consider a WAF rule restricting access to the plugin's login endpoints.