CVE-2026-14559

The teddy-bear-customize-addon plugin for WordPress versions up to 1.0.5 is vulnerable due to a lack of password verification during user authentication, enabling unauthenticated attackers to gain access as any registered user, including those with administrative privileges, by simply providing the user's email address. This critical vulnerability poses a significant risk to WordPress sites utilizing this plugin, and all administrators should prioritize immediate updates or remediation to mitigate potential unauthorized access.