CVE-2026-93757

The Wild Apricot Login plugin for WordPress (all versions up to and including 1.0.18 ) is vulnerable to an Authentication Bypass via SSO Email-Collision Account Binding. The vulnerability occurs because the plugin falls back to a network-global get_user_by('email', ...) lookup in Module.php when ...