1.36.1 — Security fix: wallet-login account takeover

Security release — please update immediately

CardanoPress 1.36.1 fixes a critical authentication vulnerability in the Cardano wallet login flow that could allow a pre-authentication account takeover.

Impact

The wallet login correctly verified a CIP-8 / COSE_Sign1 signature over the connecting wallet's address — but the WordPress account identity was taken from a separate stake-address value that the signature never covered. Because every Cardano stake address is public, on-chain data, an attacker who signs a login challenge with their own wallet could be logged in as any user simply by submitting that user's stake address — without knowing any secret.

Any site that uses CardanoPress wallet login for account creation or authentication is affected.

Severity: Critical (unauthenticated account takeover).

The fix

• The stake address used as the account identity is now derived server-side from the signature-covered wallet address, so it can no longer be substituted with someone else's.
• The previously-trusted stake_address request parameter is ignored entirely.
• Enterprise addresses (which carry no stake credential) are now rejected at login.

No configuration changes are required. Existing accounts continue to work unchanged — stake addresses are stable, so legitimate identities are unaffected.

Action required

1. Update to 1.36.1 as soon as possible.
2. Audit for prior compromise. This release ships a read-only audit script that flags any account whose stored stake address does not match the wallet it was created with. It is in the source repository (not bundled in the wordpress.org download):
   tools/audit-stake-binding.php
   Download it, place it on your server, and run with WP-CLI from your WordPress root:

   wp eval-file /path/to/audit-stake-binding.php

   Investigate any account reported as SUSPECT.

Credit

Thanks to Cullah (@CullahMusic, valt.digital) for responsibly reporting this vulnerability.

---

Full changelog: see readme.txt.