CVE-2026-14559: WordPress Teddy Bear Customize Auth Bypass

CVE-2026-14559 Overview

CVE-2026-14559 is an authentication bypass vulnerability in the Teddy Bear Customize Addon WordPress plugin through version 1.0.5. The plugin authenticates users based solely on an email address without verifying the associated password. Unauthenticated attackers can log in as any registered user, including administrators, by supplying only the target's email address. The flaw is categorized under [CWE-287] Improper Authentication and is exploitable remotely over the network without user interaction.

Critical Impact

Any unauthenticated attacker who knows or guesses an administrator's email address can gain full administrative access to the affected WordPress site.

Affected Products

• Teddy Bear Customize Addon WordPress plugin, all versions through 1.0.5
• WordPress sites with the plugin installed and activated
• Administrator, editor, and subscriber accounts registered on affected sites

Discovery Timeline

• 2026-09-11 - CVE-2026-14559 published to NVD
• 2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-14559

Vulnerability Analysis

The Teddy Bear Customize Addon plugin exposes an authentication routine that accepts an email address and issues a valid authenticated session for the corresponding WordPress user. The routine does not compare a submitted password against the stored hash. As a result, possession of an email address is sufficient to assume that user's identity.

Administrator email addresses are frequently exposed through author archive pages, wp-json/wp/v2/users endpoints, comment metadata, or public WHOIS data. This makes reconnaissance trivial for an attacker targeting a specific site. Successful exploitation grants full site control, including plugin installation, arbitrary PHP execution through theme editing, and database access through the WordPress dashboard.

Root Cause

The root cause is a missing credential verification step in the plugin's custom login handler. The handler calls WordPress session-creation functions such as wp_set_auth_cookie() after resolving a user by email, but omits any call to wp_check_password() or an equivalent password validation routine. This satisfies the classic [CWE-287] Improper Authentication pattern.

Attack Vector

Exploitation requires a single HTTP request to the plugin's login endpoint with the target email address as a parameter. No authentication, no elevated privileges, and no user interaction are required. The server responds with authentication cookies scoped to the impersonated account. See the WPScan Vulnerability Report for technical details of the vulnerable code path.

Detection Methods for CVE-2026-14559

Indicators of Compromise

• Successful WordPress logins in access logs without a preceding wp-login.php POST containing password fields
• New administrator accounts, plugin installations, or theme file modifications not attributable to known admin activity
• Session cookies issued to administrator accounts from unfamiliar IP addresses or geolocations
• Requests to plugin-specific endpoints belonging to teddy-bear-customize-addon followed immediately by authenticated dashboard activity

Detection Strategies

• Inventory WordPress installations and flag any site running the Teddy Bear Customize Addon plugin at version 1.0.5 or earlier
• Correlate authenticated session establishment events with the presence of preceding password submission traffic
• Deploy web application firewall rules that inspect POST bodies to the plugin's login handler and alert on requests lacking a password parameter

Monitoring Recommendations

• Forward WordPress audit logs, web server access logs, and WAF telemetry to a centralized analytics platform for correlation
• Alert on creation of new users with the administrator role and on changes to existing user email addresses
• Monitor for outbound requests from the web server that could indicate post-compromise webshell activity or data exfiltration

How to Mitigate CVE-2026-14559

Immediate Actions Required

• Deactivate and remove the Teddy Bear Customize Addon plugin from all affected WordPress sites until a patched version is confirmed available
• Rotate passwords for all administrator and privileged accounts on sites where the plugin was installed
• Audit the WordPress user table, wp_options, installed plugins, and theme files for unauthorized changes
• Invalidate existing authentication sessions by rotating the WordPress secret keys in wp-config.php

Patch Information

No fixed version is identified in the available advisory data. The plugin is reported vulnerable through version 1.0.5. Consult the WPScan Vulnerability Report for the latest patch status and remove the plugin if no update is available.

Workarounds

• Uninstall the plugin entirely as the most reliable mitigation
• Restrict access to wp-admin and the plugin's endpoints using IP allowlists at the web server or WAF layer
• Obscure administrator email addresses by disabling the REST API user enumeration endpoint and removing author archives
• Enforce multi-factor authentication through a separate plugin so that a bypassed password check alone does not grant dashboard access

# Disable REST API user enumeration in functions.php
add_filter('rest_endpoints', function ($endpoints) {
    if (isset($endpoints['/wp/v2/users'])) {
        unset($endpoints['/wp/v2/users']);
    }
    if (isset($endpoints['/wp/v2/users/(?P<id>[\d]+)'])) {
        unset($endpoints['/wp/v2/users/(?P<id>[\d]+)']);
    }
    return $endpoints;
});