CVE-2026-18052

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/e1e8c313-f7ea-4f3a-85c0-4f33dfe0710d/

Configurations

No configuration.

History

12 Oct 2026, 16:10

Type	Values Removed	Values Added
Summary		(es) El plugin de WordPress ManageWP Worker anterior a la versión 4.9.37 no vincula la cuenta que se está iniciando sesión a la firma que autoriza el inicio de sesión, ni evita que un enlace de inicio de sesión ya utilizado sea reutilizado, permitiendo a los atacantes que obtienen dicho enlace obtener una sesión como cualquier usuario del sitio, incluyendo un administrador.

Information

Published : 2026-08-22 06:16

Updated : 2026-10-12 16:10

NVD link : CVE-2026-18052

Mitre link : CVE-2026-18052

CVE.ORG link : CVE-2026-18052

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-18052", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18052", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-23T15:27:09.852982Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "ManageWP Worker", "versions": [{"status": "affected", "version": "0", "lessThan": "4.9.37", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-22T06:16:15.647", "references": [{"url": "https://wpscan.com/vulnerability/e1e8c313-f7ea-4f3a-85c0-4f33dfe0710d/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator."}, {"lang": "es", "value": "El plugin de WordPress ManageWP Worker anterior a la versi\u00f3n 4.9.37 no vincula la cuenta que se est\u00e1 iniciando sesi\u00f3n a la firma que autoriza el inicio de sesi\u00f3n, ni evita que un enlace de inicio de sesi\u00f3n ya utilizado sea reutilizado, permitiendo a los atacantes que obtienen dicho enlace obtener una sesi\u00f3n como cualquier usuario del sitio, incluyendo un administrador."}], "lastModified": "2026-10-12T16:10:00.220", "sourceIdentifier": "contact@wpscan.com"}