A critical authentication bypass vulnerability in The Pressengine WordPress plugin allows unauthenticated attackers to hijack administrative sessions and gain full control over the affected site.

This vulnerability is caused by an improper authentication mechanism (CWE-287) within the plugin login handler. The handler fails to terminate the authentication process when credentials are invalid, which permits an unauthenticated attacker to successfully authenticate as any user, including high-privileged administrators.

The potential impact of this vulnerability is critical, as evidenced by its CVSS score of 9.8. Successful exploitation grants an attacker full administrative access to the WordPress environment, leading to complete system compromise, unauthorized data exfiltration, and the potential for persistent backdoors or malware injection. Such a breach poses severe risks to organizational data integrity and operational continuity.

Immediate Action: Due to the severity of this flaw, administrators should immediately deactivate and remove the Pressengine plugin from their WordPress installation until a verified patch is released by the vendor.

Proactive Monitoring: Review web server access logs for anomalous login patterns or spikes in unauthorized access attempts directed at the WordPress login endpoint.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to block suspicious traffic patterns, although deactivation remains the only guaranteed method of prevention.

Public Exploit Available: Unknown.

Given the critical nature of this vulnerability and the potential for full site takeover, immediate action is required. Organizations using The Pressengine plugin must prioritize its removal to eliminate the attack vector, as no official patch has been confirmed at this time. Monitor vendor communication channels closely for updates regarding a fix.