Wurdey CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

CRITICAL Wurdey CVE published 2026-11-06

CVE-2026-110955

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username. This vulnerability allows attackers to bypass authentication mechanisms, potentially leading to unauthorized access and control of WordPress installations. Defenders should assess exposure a [truncated]