CVE-2026-14559
CriticalCVSS 9.8Summary
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.
Risk Assessment
An attacker can take over an administrator account without knowing the password, leading to full control of the WordPress site. This results in the ability to modify content, install malware, and steal data.
Recommendation
Immediately update the teddy-bear-customize-addon plugin to a fixed version or disable and remove it. Check logs for unauthorized logins.
Other vulnerabilities in teddy-bear-customize-addon WordPress plugin
See all- CVE-2026-14562Medium
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not perform any authorization or ownership checks before returning WooCommerce order metadata and the URLs of customer-uploaded attachments. This allows unauthenticated attackers to disclose other customers' order and attachment data.
- CVE-2026-14560Critical
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not properly validate uploaded files, relying on a client-supplied content type and preserving the original filename, allowing unauthenticated attackers to upload arbitrary PHP files and execute code on the server.
Original NVD description (English source)
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.