CVE-2026-86709 describes an improper authentication vulnerability (CWE-287) in The Pressengine WordPress plugin through version 1.0. The flaw occurs because the login handler does not prevent session issuance upon failed authentication attempts, enabling attackers without valid credentials to gain authenticated sessions as arbitrary users, including administrative accounts.

An attacker can bypass authentication controls and gain unauthorized access to any user account, including administrator accounts. This could lead to full compromise of the affected WordPress site, allowing unauthorized actions such as content modification, user management, or further exploitation.

No patch or official fix information is currently available. Users should monitor the vendor's advisory for updates and consider disabling or replacing the plugin until a fix is released. Implementing additional access controls or multi-factor authentication at the WordPress level may help mitigate risk temporarily.