Authentication Bypass in Swipe WordPress Plugin by Swipe
CVE-2026-119258
Key Information:
Badges
What is CVE-2026-119258?
The Swipe WordPress plugin prior to version 1.4 is vulnerable to an authentication bypass flaw. This vulnerability allows unauthorized attackers to gain access to the WordPress session of existing users, including administrators. By exploiting this flaw, attackers can issue a WordPress session cookie without proper authentication, potentially taking control of the affected user accounts if those users have an active app session. This severe oversight in session management poses a significant risk to WordPress installations using the Swipe plugin.
Affected Version(s)
Swipe 0 <= 1.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.