#NØØT_Security_Alerts 🚨 #ALERT — CRITICAL FREETON WP FLAW ENABLES UNAUTHENTICATED ADMINISTRATOR ACCOUNT TAKEOVER October 9, 2026 DISCLOSED BY: WPScan PRODUCT: Freeton WP — WordPress Plugin CVE: CVE-2026-84737 SEVERITY: Critical — CVSS 9.8 AFFECTED VERSIONS: 1.0.0 and earlier. No verified fix available. IMPACT: Unauthenticated attackers can bypass activation-code validation and authenticate as any user whose email address they know, including administrators. Successful administrator impersonation may enable complete website takeover. EXPLOITATION STATUS: VERIFIED VULNERABILITY. WPScan confirms the authentication weakness. Researcher PoC details are withheld until November 9, 2026. No confirmed in-the-wild exploitation. Forensic triage: Investigate suspicious login requests involving the secod parameter, unexpected administrator sessions, unfamiliar source IPs, and unauthorized account or plugin changes. No confirmed malicious IOCs published. URGENT ACTION: Disable Freeton WP until a verified security fix becomes available. Investigate suspicious authentication activity, terminate unauthorized sessions, and review administrator accounts. SOURCE: https://wpscan.com/vulnerability/b26e6b42-0c9f-4b6b-ac2c-2e452038288b/ CONFIDENCE: HIGH — WPScan-verified vulnerability. Real-world exploitation remains unconfirmed. #CyberSecurity #ThreatIntel #WordPress #AuthenticationBypass #AccountTakeover