What is GHSA-4fpp-jjwf-mmjc?

GHSA-4fpp-jjwf-mmjc is a security advisory published by GitHub Security Advisories with Critical severity. The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password...

Which CVE IDs does GHSA-4fpp-jjwf-mmjc cover?

GHSA-4fpp-jjwf-mmjc covers the following CVE IDs: CVE-2026-14559. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-4fpp-jjwf-mmjc?

GHSA-4fpp-jjwf-mmjc has a CVSS v3 base score of 9.8, published by GitHub Security Advisories.

GHSA-4fpp-jjwf-mmjcCriticalCVSS 9.8

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password...

Vendor

GitHub Security Advisories

Published

September 11, 2026

Last Modified

September 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-14559 →

📋 Description

The teddy-bear-customize-addon WordPress plugin through 1.0.5 does not verify a user's password before authenticating them, allowing unauthenticated attackers to log in as any registered user, including administrators, by supplying only that user's email address.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-14559
https://wpscan.com/vulnerability/90cbbed5-9662-4405-88b8-bd55854dccdf
https://github.com/advisories/GHSA-4fpp-jjwf-mmjc