CVE-2026-14559

CVE-2026-14559 is a critical authentication flaw (CWE-287) in the teddy-bear-customize-addon WordPress plugin, which authenticates users without verifying their password. An unauthenticated attacker who knows or guesses a registered user's email address can authenticate as that user through the plugin's login flow with no password required. Because the impersonated accounts include administrators, an attacker gains full control of the WordPress site, including the ability to install plugins or themes, edit files, and create new admin users for persistence. Any WordPress site running the plugin at version 1.0.5 or earlier is affected; the flaw requires no privileges or user interaction and is trivially exploitable over the network (CVSS 3.1: 9.8). No public proof-of-concept is known, the issue is not in CISA's KEV, and no in-the-wild exploitation has been documented as of this analysis.

What to do: Deactivate or remove the teddy-bear-customize-addon plugin until a patched release beyond 1.0.5 is available, then update immediately, as no fixed version is documented in the data. Review authentication logs for administrator sign-ins without corresponding password activity, and rotate or reset credentials for privileged accounts if any suspicious logins are found. As an interim mitigation, a WAF rule or enforced password check on the plugin's login path can block the bypass.