CVE-2026-93757— Wild Apricot 1.0.18 多站点SSO 认证绕过漏洞
一分钟漏洞结论
影响对象
wild-apricot Wild Apricot Login
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
WordPress 的 Wild Apricot Login 插件在所有 1.0.18 及更早版本中，存在通过 SSO（单点登录）邮箱碰撞导致的账户绑定认证绕过漏洞。当插件未找到与 incoming SSO 登录请求对应的 WildApricot 联系人 ID 映射时，会在 中回退到使用网络全局范围的 函数来查找 WordPress 用户；随后， 会将该用户与 WildApricot 联系人绑定，并由 通过 为该用户签发会话 Cookie。整个流程仅受 检查保护，却从未要求提供对匹配 WordPress 账户所有权
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-93757 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Wild Apricot Login <= 1.0.18 - Authentication Bypass via SSO Email-Collision Account Binding on Multisite
来源: CVE Program / CVE List V5
Vulnerability Description
The Wild Apricot Login plugin for WordPress is vulnerable to Authentication Bypass via SSO Email-Collision Account Binding in all versions up to, and including, 1.0.18. When no WildApricot contact-ID mapping is found for an incoming SSO login, the plugin falls back to a network-global `get_user_by('email', ...)` lookup in `Module.php` to resolve a WordPress user, then `UserSynchronizer::syncWaContact()` binds and `Controller::login()` issues a session cookie via `wp_set_auth_cookie()` for that resolved user — both guarded only by `is_super_admin()` — without ever requiring proof of ownership of the matched WordPress account such as a password, local account-linking confirmation, inbox verification, or administrator approval. This makes it possible for attackers with custom-level WildApricot membership access to authenticate as an existing WordPress subsite administrator on a path-based Multisite network, obtaining a valid network-global authentication cookie for the victim without their credentials. Exploitation requires that the attacker control a WildApricot contact whose email address matches the target WordPress administrator's email — achievable via a public zero-fee membership application on the connected WildApricot organization — and that they complete the SSO flow on any subsite where Wild Apricot Login is active; because WordPress user identities and authentication cookies are network-global, the cookie issued on that subsite is equally valid on any other subsite where the victim user holds an administrator role.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
来源: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| wild-apricot | Wild Apricot Login | 0 ~ 1.0.18 | - |
|
二、漏洞 CVE-2026-93757 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-93757 的情报信息
请登录查看更多情报信息。