CVE-2026-14557
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The SoftMarket — Digital Marketplace WordPress plugin through version 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow. This allows unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.
Risk Assessment
An attacker can impersonate any verified user, including an administrator, leading to unauthorized access and potential account takeover.
Recommendation
Update the SoftMarket — Digital Marketplace plugin to a version above 1.0.0 or apply a patch that properly validates the authentication token.
Original NVD description (English source)
The SoftMarket — Digital Marketplace WordPress plugin through 1.0.0 does not properly validate an authentication token in one branch of its email-verification flow, allowing unauthenticated attackers to obtain a valid session as any verified user by supplying only that user's ID.