Wurdey vulnerabilities

CVEs whose affected-version data names the Wurdey package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-110955Critical· 9.8

yesterday

Wurdey <= 1.0.0 - Unauthenticated Administrator Authentication Bypass

The Wurdey WordPress plugin through 1.0.0 does not verify a request signature before logging a user in, allowing unauthenticated attackers to authenticate as an administrator knowing only the administrator's username.

▾ MidnightEPSS 0.34%via CVEORG