CVE-2026-19125 in EthPress Plugin
Summary
by MITRE • 09/24/2026
The EthPress – Web3 Login plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 2.3.5. This is due to the verify_login() function in app/Login.php containing a missing return statement in the signature verification failure branch — when Signature::verify2() reports a mismatch, the function only assigns a WP_Error to a local variable and continues executing, causing unconditional fall-through to the login block where Address::log_in() calls wp_set_auth_cookie() regardless of whether the submitted signature is valid. This makes it possible for unauthenticated attackers to log in as any WordPress user who has a linked wallet address — including administrators — by submitting that user's public wallet address alongside an arbitrary well-formed signature, enabling full site takeover.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The EthPress Web3 Login plugin for WordPress presents a critical authentication bypass vulnerability affecting all versions up to and including 2.3.5. This flaw resides within the core login verification logic, specifically in the verify_login function located in app/Login.php. The issue stems from improper control flow handling during cryptographic signature validation. When the system attempts to authenticate a user via their linked Ethereum wallet address, it relies on verifying a digital signature provided by the client. However, the implementation fails to enforce strict termination of execution upon verification failure, allowing attackers to bypass authentication mechanisms entirely and gain unauthorized access to any account associated with a known public wallet address.
The technical root cause is a missing return statement in the error handling branch of the verify_login function. During normal operation, the system calls Signature::verify2() to validate the cryptographic signature against the user's public key. If this verification fails due to a mismatch or invalid data, the code assigns a WP_Error object to a local variable intended to indicate failure. Crucially, however, the function does not return immediately after setting this error state. Instead, it allows execution to fall through unconditionally into the subsequent login block. This logical flaw means that regardless of whether the signature is valid or invalid, the script proceeds to execute Address::log_in().
This unconditional fall-through leads directly to a severe operational impact where wp_set_auth_cookie() is invoked without confirming successful authentication. The WordPress function wp_set_auth_cookie establishes a session for the specified user by setting necessary cookies in the browser and updating database entries to mark the user as logged in. Because this call occurs irrespective of signature validity, an attacker can authenticate as any user whose wallet address has been previously linked within the system. This includes high-privilege accounts such as administrators, thereby enabling a complete site takeover with no need for valid credentials or correct cryptographic proofs.
From a classification perspective, this vulnerability aligns with CWE-287 Improper Authentication and CWE-431 Missing Critical Step in Business Logic Flow. The failure to halt execution upon authentication verification failure represents a fundamental breakdown in the security control chain. In terms of adversary behavior, this technique corresponds to ATT&CK T1078 Valid Accounts, where an attacker leverages legitimate credentials or identifiers—in this case, valid wallet addresses—to gain initial access without detection by standard credential-based monitoring systems. The ability to impersonate any user with a linked wallet effectively nullifies the security guarantees provided by Web3 authentication methods when implemented incorrectly.
Mitigation strategies must address both immediate remediation and long-term architectural improvements. For administrators using affected versions, upgrading to version 2.3.6 or later is essential as it resolves this logic error by ensuring proper return statements are executed upon signature verification failure. Until an upgrade can be performed, temporary mitigations include disabling the Web3 login feature if not strictly required, restricting access to administrative areas via IP whitelisting, and implementing additional multi-factor authentication layers that do not rely solely on wallet signatures. Developers should also conduct a thorough review of all cryptographic validation functions in similar plugins to ensure strict adherence to fail-secure principles where any deviation from expected valid states results in immediate termination of the authentication process rather than continued execution.