Authentication bypass in WordPress plugins
Authentication bypass means an attacker can log in as someone else without their password. Common causes are login-with-social-account or one-time-login features that trust the wrong value, and password reset flows that can be abused.
If the account they can take over is an administrator, they have full control of the site. These records are often rated critical.
What to do: update the plugin. Check Users for unfamiliar administrators and look at recent logins if you have a log. Turn on two-factor authentication for admins; it does not fix the bug, but it limits other ways in.
Worried a plugin bug was used on your site?
The free scan reads the public side of your site and looks for spam pages, hidden redirects, injected scripts and blacklist entries. No login, no install, about a minute.
Newest Authentication bypass records
300 on record for the plugins we track; the newest 100 are below. Data as of 2026-11-04.
“Affected” is the version range the source gives. “Fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version. Each CVE id links to the full record on the plugin’s page.
-
high 8.1 SureCart
Authentication bypass
-
high 8.1 Easy Digital Downloads
Authentication bypass
-
critical 9.8 Uncanny Toolkit for LearnDash
Authentication bypass
-
high 8.1 Wp Social Login and Register Social Counter
Authentication bypass
-
high 7.5 Security Optimizer
Authentication bypass
-
medium 6.5 Page and Post Restriction
Authentication bypass
-
high 7.5 Security Plugin, Firewall & Malware Scanner wi…
Authentication bypass
-
medium 4.3 Points Management System For Gamification, Ran…
Authentication bypass
-
medium 6.5 PAYCOMET for WooCommerce
Authentication bypass
-
high 7.5 All-In-One Security (AIOS)
Authentication bypass
-
high 8.1 SSL Wireless SMS Notification
Authentication bypass
-
high 7.5 Wild Apricot Login
Authentication bypass
-
critical 9.8 Bot for Telegram on WooCommerce
Authentication bypass
-
medium 4.8 Customer Email Verification for WooCommerce
Authentication bypass
-
critical 9.8 Jupiter X Core
Authentication bypass
-
critical 9.8 SureCart
Authentication bypass
-
high 7.5 Royal MCP
Authentication bypass
-
low 3.7 Cart Abandonment Recovery for WooCommerce
Authentication bypass
-
high 7.5 miniOrange 2FA
Authentication bypass
-
medium 6.5 WholesaleX
Authentication bypass
-
medium 6.5 2Way VideoCalls and Random Chat
Authentication bypass
-
critical 9.1 Appointment Booking Plugin
Authentication bypass
-
high 8.1 Vulnity Security
Authentication bypass
-
high 7.4 OTP Login & Register Woocommerce
Authentication bypass
-
medium 4.8 Salon Booking System
Authentication bypass
-
high 8.1 miniOrange OTP Login, Verification and SMS Not…
Authentication bypass
-
high 7.4 Appointment Booking Plugin
Authentication bypass
-
high 7.3 eRoom
Authentication bypass
-
critical 9.8 WPCOM Member
Authentication bypass
-
high 8.1 WPO365
Authentication bypass
-
high 8.1 SMS Alert
Authentication bypass
-
medium 5.3 Contest Gallery
Authentication bypass
-
high 8.1 Advanced Form Integration
Authentication bypass
-
critical 9.8 Advanced IP Blocker
Authentication bypass
-
medium 4.8 Jetpack
Authentication bypass
-
medium 5.4 Jetpack
Authentication bypass
-
high 7.5 Forminator Forms
Authentication bypass
-
high 7.5 GiveWP
Authentication bypass
-
critical 9.8 Ultimate Multisite
Authentication bypass
-
high 8.8 Simple JWT Login
Authentication bypass
-
high 7.5 Graphina
Authentication bypass
-
medium 5.3 Advanced Google reCAPTCHA
Authentication bypass
-
medium 4.3 Burst Statistics
Authentication bypass
-
high 7.5 WP 2FA
Authentication bypass
-
critical 9.8 JSON API Auth
Authentication bypass
-
critical 9.8 Ultimate Multisite
Authentication bypass
-
critical 9.1 GiveWP
Authentication bypass
-
medium 5.4 Blacklist Manager
Authentication bypass
-
critical 9.8 miniOrange OTP Login, Verification and SMS Not…
Authentication bypass
-
high 8.1 EthPress
Authentication bypass
-
critical 9.0 WP OAuth Server ( Login with WordPress )
Authentication bypass
-
high 7.3 E-cab Taxi Booking Manager for Woocommerce
Authentication bypass
-
critical 9.8 EduAdmin Booking
Authentication bypass
-
high 7.5 Really Simple Security
Authentication bypass
-
medium 5.3 SSL Zen
Authentication bypass
-
medium 5.3 OTP Login & Register Woocommerce
Authentication bypass
-
high 7.3 WP Travel
Authentication bypass
-
medium 6.5 IMPress for IDX Broker
Authentication bypass
-
high 7.1 MailMunch
Authentication bypass
-
high 7.5 miniOrange 2FA
Authentication bypass
-
critical 9.8 ACF Frontend Admin by DynamiApps
Authentication bypass
-
high 7.5 HivePress Authentication
Authentication bypass
-
critical 9.8 MStore API
Authentication bypass
-
high 7.4 Really Simple Security
Authentication bypass
-
high 8.1 OAuth Single Sign On
Authentication bypass
-
high 8.1 Advanced Custom Fields
Authentication bypass
-
medium 5.3 Simple Membership
Authentication bypass
-
high 8.8 Support Genix
Authentication bypass
-
high 7.4 RegistrationMagic
Authentication bypass
-
high 7.5 SAML Single Sign On
Authentication bypass
-
high 8.2 User Profile Builder
Authentication bypass
-
medium 5.3 Essential Addons for Elementor
Authentication bypass
-
high 8.1 MalCare WordPress Security Plugin
Authentication bypass
-
medium 6.5 Booking for Appointments and Events Calendar
Authentication bypass
-
high 7.3 Privacy Policy Generator, Terms & Conditions,…
Authentication bypass
-
high 8.1 ManageWP Worker
Authentication bypass
-
critical 9.8 Wawp Country Code & Chat Widget for WooCommerce
Authentication bypass
-
medium 5.4 Welcart e-Commerce
Authentication bypass
-
high 7.6 Leyka
Authentication bypass
-
medium 5.3 Membership For WooCommerce
Authentication bypass
-
high 8.8 SAML Single Sign On
Authentication bypass
-
medium 6.5 Flutterwave WooCommerce
Authentication bypass
-
medium 6.5 affects latest 3.2.0 Piraeus Bank WooCommerce Payment Gateway
Authentication bypass
-
high 7.1 MWB HubSpot for WooCommerce
Authentication bypass
-
critical 9.1 Customer Engagement System
Authentication bypass
-
medium 6.5 Contact Form by Supsystic
Authentication bypass
-
high 7.5 Ezoic
Authentication bypass
-
critical 9.1 Simple JWT Login
Authentication bypass
-
critical 9.8 User Profile Builder
Authentication bypass
-
medium 6.5 Backup Migration
Authentication bypass
-
critical 9.8 6Storage Rentals
Authentication bypass
-
critical 9.8 User Session Synchronizer
Authentication bypass
-
critical 9.8 Salon Booking System
Authentication bypass
-
high 8.1 Social Login, Passkeys, Magic Link & Email OTP
Authentication bypass
-
high 8.8 CheckView
Authentication bypass
-
critical 9.8 Single Sign On For TNG
Authentication bypass
-
high 8.2 Arvow AI SEO Writer
Authentication bypass
-
medium 5.3 Appointment Hour Booking
Authentication bypass
-
medium 4.8 Newsletters
Authentication bypass
-
high 8.1 MStore API
Authentication bypass
Other types
Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution · Arbitrary file upload · Path traversal and file read · File inclusion · Server-side request forgery (SSRF) · Arbitrary file deletion · Open redirect · Denial of service · Content injection
Browse vulnerabilities
Common types: Cross-site scripting (XSS) · Missing authorization · Cross-site request forgery (CSRF) · SQL injection · Sensitive data exposure · PHP object injection · Privilege escalation · Remote code execution
Where this data comes from
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Plugin versions, update dates and install counts: the wordpress.org Plugins API.
- These lists cover the 3,948 plugins in our catalogue, not every plugin on wordpress.org. We only list a CVE for a plugin when its references or its advisory name that exact plugin, so a few real issues may be missing. Spot an error? Email Daniel.