Critical severity9.8NVD Advisory· Published Sep 11, 2026· Updated Sep 11, 2026
CVE-2026-14559
CVE-2026-14559
Description
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=1.0.5
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 7, 2026 to September 13, 2026)Wordfence Blog · Sep 17, 2026