CVE-2026-19125: EthPress Web3 Login Auth Bypass Vulnerability

CVE-2026-19125 Overview

The EthPress – Web3 Login plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 2.3.5. The verify_login() function in app/Login.php fails to return when signature verification fails, allowing execution to fall through to the login block. Unauthenticated attackers can log in as any WordPress user with a linked wallet address, including administrators, by submitting the target's public wallet address alongside an arbitrary well-formed signature. Successful exploitation results in full site takeover. The vulnerability is classified under [CWE-287] Improper Authentication.

Critical Impact
Unauthenticated attackers can authenticate as administrators of WordPress sites running EthPress ≤ 2.3.5, resulting in complete site compromise.

Affected Products

EthPress – Web3 Login plugin for WordPress, versions ≤ 2.3.5
WordPress installations using EthPress for wallet-based authentication
Any site with administrator accounts linked to an Ethereum wallet address via EthPress

Discovery Timeline

2026-09-23 - CVE-2026-19125 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-19125

Vulnerability Analysis

EthPress authenticates users by verifying a cryptographic signature produced by an Ethereum wallet against a nonce tied to a specific wallet address. The verify_login() function in app/Login.php is responsible for validating this signature before authentication proceeds. When Signature::verify2() reports a signature mismatch, the code assigns a WP_Error object to a local variable but omits a return statement. Execution continues past the failure branch into the login block, where Address::log_in() invokes wp_set_auth_cookie() unconditionally. The result is that the outcome of signature verification has no effect on whether an authentication cookie is issued.

Root Cause

The root cause is a missing return statement in the failure branch of the signature verification logic. This is a control-flow defect: the function correctly detects invalid signatures and constructs the expected WP_Error response but does not halt execution. The vulnerability maps to [CWE-287] Improper Authentication because the authentication decision is made independently of the signature check result.

Attack Vector

Exploitation is remote and requires no authentication or user interaction. An attacker enumerates or obtains a public Ethereum wallet address linked to a WordPress user account, ideally an administrator. The attacker then submits an authentication request to the EthPress login endpoint containing that wallet address and any syntactically well-formed signature value. Because verification failure does not terminate the flow, the plugin issues a valid authentication cookie for the targeted account. Wallet addresses are public data by design, and linkages between wallets and site administrators can often be inferred from public blockchain activity or site metadata.

See the Wordfence Vulnerability Analysis and the vulnerable code in Login.php line 46 and Login.php line 51 for the exact control-flow defect.

Detection Methods for CVE-2026-19125

Indicators of Compromise

Successful WordPress administrator logins originating from IP addresses with no prior login history for that account.
Authentication events for wallet-linked accounts occurring without a preceding valid nonce request pattern in access logs.
Creation of new administrator users, plugin installations, or theme modifications shortly after an EthPress login event.
WordPress auth_cookie issuance events for privileged users where the requesting client sent a signature value that does not correspond to any prior wallet interaction.

Detection Strategies

Audit the EthPress plugin version across all managed WordPress sites and flag installations at or below 2.3.5.
Enable WordPress authentication logging and correlate wp_set_auth_cookie events with the source IP and request payload of the associated EthPress login call.
Review web server access logs for POST requests to EthPress login endpoints containing wallet address parameters, especially from unfamiliar user agents or IP ranges.
Monitor for unexpected changes to administrator accounts, user roles, and plugin/theme files following any EthPress authentication event.

Monitoring Recommendations

Ingest WordPress and web server logs into a centralized SIEM to correlate authentication anomalies with file-integrity and configuration changes.
Alert on newly created WordPress administrator accounts and privilege elevation events regardless of source.
Track outbound connections from WordPress hosts to unfamiliar domains, which may indicate post-exploitation command-and-control or data staging.

How to Mitigate CVE-2026-19125

Immediate Actions Required

Update EthPress to the patched release above 2.3.5 as documented in WordPress Plugin Changeset 3683106.
If a patched version cannot be deployed immediately, deactivate and remove the EthPress plugin from all WordPress sites.
Rotate credentials and force password resets for all administrator accounts, and invalidate active WordPress sessions.
Review WordPress user lists, scheduled tasks, plugins, and themes for unauthorized modifications introduced during the exposure window.

Patch Information

The vendor addressed the missing return statement in app/Login.php via WordPress Plugin Changeset 3683106. The fix ensures that when Signature::verify2() reports a mismatch, verify_login() returns the WP_Error immediately and does not fall through to Address::log_in(). Site operators should confirm the deployed plugin version is above 2.3.5 after patching. Reference the WordPress Plugin Code Review and WordPress Plugin Core Code for context on the surrounding authentication flow.

Workarounds

Deactivate EthPress until the patched version is installed; wallet-based login will be unavailable but standard WordPress authentication remains functional.
Restrict access to WordPress login endpoints (wp-login.php and any EthPress AJAX handlers) via IP allowlists or a web application firewall while remediation is pending.
Temporarily unlink wallet addresses from administrator accounts to remove them as authentication targets for the vulnerable code path.
Enforce multi-factor authentication for all WordPress administrators to raise the cost of any post-bypass session use.

bash

# Verify installed EthPress version and disable if vulnerable
wp plugin get ethpress --field=version
wp plugin deactivate ethpress

# After updating to a patched release, confirm version > 2.3.5
wp plugin update ethpress
wp plugin get ethpress --field=version