CVE-2026-84737

Name of the Vulnerable Software and Affected Versions Freeton WP versions prior to 1.0.1

Description The plugin fails to correctly validate the activation code during user authentication. This allows unauthenticated attackers to log in as any user, including administrators, provided they know the user's email address. This flaw can lead to a complete website takeover. The issue involves the secod parameter during the authentication process.

Recommendations Disable Freeton WP until a verified security fix becomes available. Investigate suspicious authentication activity, terminate unauthorized sessions, and review administrator accounts.