{"id":"CVE-2026-84737","published":"2026-10-11T07:17:25.797","lastModified":"2026-10-13T20:36:00.850","description":"The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/b26e6b42-0c9f-4b6b-ac2c-2e452038288b/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Freeton WP WordPress plugin fails to properly validate activation codes during user authentication, allowing attackers with knowledge of any user's email address to log in as that user, including administrators. This represents a critical authentication bypass vulnerability.","exploitability":"Exploitation is straightforward for attackers who know target user email addresses, requiring no prior authentication or special privileges beyond access to the plugin's authentication endpoint.","blast_radius":"The vulnerability could allow attackers to gain administrative access to WordPress sites using the Freeton WP plugin, potentially leading to full site compromise, data exfiltration, and persistent backdoor installation across multiple affected installations.","remediation":"Upgrade to version 1.0.1 or later which includes proper activation code validation in the authentication process.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["auth-bypass","wordpress","authentication","privilege-escalation"],"model":"garnet-coder","analyzedAt":"2026-10-12T08:50:56.363Z"}}