CVE-2026-84737

Summary

The Freeton WP WordPress plugin fails to properly validate activation codes during user authentication, allowing attackers with knowledge of any user's email address to log in as that user, including administrators. This represents a critical authentication bypass vulnerability.

Exploitability

Exploitation is straightforward for attackers who know target user email addresses, requiring no prior authentication or special privileges beyond access to the plugin's authentication endpoint.

Blast radius

The vulnerability could allow attackers to gain administrative access to WordPress sites using the Freeton WP plugin, potentially leading to full site compromise, data exfiltration, and persistent backdoor installation across multiple affected installations.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 1.0.1 or later which includes proper activation code validation in the authentication process.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.