PT-2026-7806 · WordPress · Adforest

Phat Rio · Published 2026-02-12 · Updated 2026-02-23 · CVE-2026-1729

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AdForest versions up to and including 6.0.12

Description The AdForest theme for WordPress is susceptible to authentication bypass. The issue stems from insufficient user identity verification before authentication via the sb login user with otp fun function. This allows unauthenticated attackers to log in as any user, including administrators.

Recommendations Versions prior to and including 6.0.12 should be updated when a patch becomes available. As a temporary workaround, consider restricting access to the sb login user with otp fun function until a patch is available.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-1729

Affected Products

Adforest

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-1729 · Security Note
• https://twitter.com/CVEnew/status/2021799452823237001 · Twitter Post
• https://twitter.com/offseq/status/2021781354048811020 · Twitter Post
• https://themeforest.net/item/adforest-classified-wordpress-theme/19481695 · Note
• https://twitter.com/CveFindCom/status/2021980458796327264 · Twitter Post
• https://twitter.com/MNovofastovsky/status/2025935223507104175 · Twitter Post
• https://t.me/CVEtracker/44499 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2021797907851014320 · Twitter Post
• https://t.me/cveNotify/151798 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/34fd42cb-3868-4b1c-bc56-575faf01e8f3?source=cve · Note