CVE-2026-93757

Name of the Vulnerable Software and Affected Versions Wild Apricot Login versions prior to 1.0.19

Description An authentication bypass exists due to SSO Email-Collision Account Binding. When no contact-ID mapping is found during an SSO login, the plugin uses a network-global get user by('email', ...) lookup in Module.php to resolve a WordPress user. Subsequently, UserSynchronizer::syncWaContact() binds the account and Controller::login() issues a session cookie via wp set auth cookie() without requiring proof of ownership, such as a password or inbox verification. This allows an attacker with a WildApricot contact email matching a target WordPress administrator's email to obtain a network-global authentication cookie and gain administrator access on a path-based Multisite network.

Recommendations Update Wild Apricot Login to version 1.0.19 or later.