CVE-2026-14557: SoftMarket WordPress Auth Bypass Flaw

CVE-2026-14557 Overview

CVE-2026-14557 is an authentication bypass vulnerability in the SoftMarket — Digital Marketplace WordPress plugin through version 1.0.0. The flaw exists in one branch of the plugin's email-verification flow, where a token is not properly validated. Unauthenticated attackers can obtain a valid session as any verified user by supplying only that user's numeric ID. The weakness is tracked under CWE-287: Improper Authentication and carries a CVSS 3.1 base score of 9.1.

Critical Impact
Remote, unauthenticated attackers can log in as any verified user, including administrators, resulting in full site compromise.

Affected Products

SoftMarket — Digital Marketplace WordPress plugin, all versions up to and including 1.0.0

Discovery Timeline

2026-08-03 - CVE-2026-14557 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-14557

Vulnerability Analysis

The SoftMarket plugin implements an email-verification flow to confirm ownership of a user account. One branch of that flow issues a WordPress authentication session based on the submitted request parameters. According to the WPScan Vulnerability Report, this branch fails to validate the accompanying verification token against the target account.

An attacker can submit a request that references an arbitrary user ID without possessing the matching token. The plugin treats the request as verified and returns a valid session cookie for the referenced account. This grants direct access to the WordPress dashboard with the target user's privileges.

Because the vulnerability is network-reachable and requires no privileges or user interaction, exploitation scales trivially against exposed sites. EPSS data published on 2026-08-06 reports a probability of 0.354% at the 28.156 percentile.

Root Cause

The root cause is missing authentication token verification in a specific code path of the email-verification handler. The handler trusts the user identifier supplied in the request and issues session credentials without cryptographically binding the token to the target account. This is a textbook [CWE-287] failure to authenticate the requester before granting a session.

Attack Vector

Exploitation is performed over HTTP or HTTPS against the plugin's public verification endpoint. An unauthenticated attacker enumerates or guesses a valid user ID, typically starting with 1 for the default administrator. The attacker submits a crafted request that triggers the vulnerable branch of the verification flow. The server responds with authentication cookies for the referenced account, which the attacker replays to access administrative functionality.

See the WPScan Vulnerability Report for endpoint and parameter details.

Detection Methods for CVE-2026-14557

Indicators of Compromise

Unexpected successful logins for administrator or shop-manager accounts originating from unfamiliar IP addresses.
WordPress wordpress_logged_in_* cookies issued to sessions that never submitted valid credentials.
New administrative users, altered user roles, or plugin and theme installations that do not match change-management records.
Requests to SoftMarket email-verification endpoints containing sequential or low-value user ID parameters.

Detection Strategies

Inspect web server access logs for POST or GET requests to the SoftMarket verification endpoint containing a user_id parameter without a plausible token value.
Correlate verification requests with subsequent authenticated sessions from the same client to identify session issuance without prior credential submission.
Alert on WordPress user_register, set_user_role, and wp_login events tied to IP addresses that only interacted with plugin endpoints.

Monitoring Recommendations

Enable verbose WordPress audit logging for authentication events and privilege changes.
Forward web access logs and WordPress audit events to a centralized SIEM for retention and correlation.
Monitor for outbound requests from the web host to unknown domains, which may indicate post-exploitation webshell activity.

How to Mitigate CVE-2026-14557

Immediate Actions Required

Deactivate and remove the SoftMarket — Digital Marketplace plugin on any site running version 1.0.0 or earlier until a fixed release is available.
Force a password reset and session invalidation for all administrator and privileged accounts.
Review the WordPress user table for unauthorized accounts and remove any that cannot be attributed to legitimate provisioning.
Audit installed plugins, themes, and wp-content/uploads for files added after the plugin was first installed.

Patch Information

At the time of publication, no fixed version has been referenced in the WPScan Vulnerability Report. Administrators should track the vendor's WordPress.org plugin listing for a release above 1.0.0 and apply it as soon as it is published.

Workarounds

Block public access to the plugin's verification endpoint at the web application firewall (WAF) or reverse proxy layer.
Restrict /wp-admin/ access to known administrator IP ranges to limit the value of any hijacked session.
Enforce multi-factor authentication for all WordPress users so that a stolen session alone is insufficient for sensitive actions.

bash

# Example nginx rule to block the vulnerable verification path
location ~* /wp-content/plugins/softmarket/.*verify.* {
    return 403;
}