WordPress Plugin Fails to Validate User Authentication Codes

The Freeton WP WordPress plugin through 1.0.0 does not correctly validate the activation code when authenticating a user, allowing unauthenticated attackers to log in as any user whose email address they know, including administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The Freeton WP WordPress plugin through version 1.0.0 contains a critical authentication bypass vulnerability (CVE-2026-84737, CVSS 9.8) stemming from improper validation of activation codes during user authentication. This flaw allows unauthenticated attackers to gain unauthorized access to WordPress sites by logging in as any user—including administrators—provided they know the target's email address. The vulnerability affects any WordPress installation running the vulnerable plugin version, potentially compromising site integrity, sensitive data, and administrative capabilities. Given the ease of exploitation and the severity of account takeover attacks, this poses an immediate and widespread threat to WordPress deployments.

Casky's 283 mapped security skills leverage Claude AI's extended reasoning to identify the attack patterns behind this vulnerability across the MITRE ATT&CK framework. Practitioners will detect exploitation indicators aligned with TA0004 (Privilege Escalation) as attackers bypass authentication controls to assume admin roles, and TA0006 (Credential Access) techniques as attackers leverage known email addresses to gain illicit access. The platform's skills analyze authentication logs for failed activation code validations followed by successful logins using known email addresses, unusual privilege elevation patterns post-authentication, and anomalous admin account access from untrusted IP ranges. Real-world findings would surface rapid authentication attempts, activation code replay patterns, and lateral movement consistent with attacker-controlled admin accounts, enabling practitioners to correlate defensive gaps and prioritize remediation against this actively exploited vulnerability class.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-84737.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-84737

Casky has 283 skills that investigate the attack patterns behind CVE-2026-84737. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn