CVE-2026-14559 — Teddy Bear Customize Addon <= 1.0.5 - Unauthenticated Account Takeover
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any r…
Published: 2026-09-11 · CVSS: 9.8 · CVSS 3.1
The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7