CVE-2026-86709 in Pressengine Plugin

Resumen

por MITRE • 2026-09-17

The Pressengine WordPress plugin through 1.0 does not stop its login handler from issuing a session when authentication fails, allowing unauthenticated attackers to log in as any user, including administrators.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

• Responsable: WPScan
• Reservar: 2026-09-08
• Divulgación: 2026-09-17
• Moderación: aceptado
• Artículo: VDB-406318
• CPE: listo
• CWE: CWE-287 (confirmado)
• CVSS: 7.3 (VulDB)
• EPSS: 0.00000
• KEV: no
• Actividades: muy bajo
• Sector: Hostingprovider

Fuentes

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-86709
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-86709
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-86709/