CVE-2026-19718

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.

CVSS v3 8.1 HIGH

8.1^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://wpscan.com/vulnerability/68892d43-912d-421f-9376-8dc6e2e906bc/

Configurations

No configuration.

History

No history.

Information

Published : 2026-08-26 06:16

Updated : 2026-08-26 16:30

NVD link : CVE-2026-19718

Mitre link : CVE-2026-19718

CVE.ORG link : CVE-2026-19718

JSON object : View

Products Affected

No product.

CWE

CWE-287

Improper Authentication

{"id": "CVE-2026-19718", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-19718", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-26T14:33:54.540994Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.2}]}, "affected": [{"source": "contact@wpscan.com", "affectedData": [{"vendor": "Unknown", "product": "BlogVault Backup & Staging", "versions": [{"status": "affected", "version": "5.16", "lessThan": "6.65", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Unknown", "product": "MalCare WordPress Security Plugin", "versions": [{"status": "affected", "version": "5.16", "lessThan": "6.65", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Unknown", "product": "The WP Remote WordPress Plugin", "versions": [{"status": "affected", "version": "5.16", "lessThan": "6.65", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-08-26T06:16:25.900", "references": [{"url": "https://wpscan.com/vulnerability/68892d43-912d-421f-9376-8dc6e2e906bc/", "source": "contact@wpscan.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-287"}]}], "descriptions": [{"lang": "en", "value": "The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site."}], "lastModified": "2026-08-26T16:30:52.723", "sourceIdentifier": "contact@wpscan.com"}