Vulnerability details
CVE-2026-18052
ManageWP Worker
ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters
CVSS 3.1
8.1High
Official description
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.1High | 3.1 | CISA ADP / Vulnrichment (CISA-ADP) | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| — | ManageWP Worker | v < 4.9.37 | CVEProject cvelistV5 (CNA) |
References and advisories
1- https://wpscan.com/vulnerability/e1e8c313-f7ea-4f3a-85c0-4f33dfe0710d/ exploitvdb-entrytechnical-description
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-08-22
- Last updated
- 2026-08-23
- State
- Published
- Assigner (CNA)
- WPScan
Exploit prediction (EPSS)
0.37%
Probability of exploitation in 30 days
31.4%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Total
Weaknesses (CWE)
- CWE-287Improper Authentication