CVE-2026-18052

HighCVSS 8.1

Published: 22/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 22/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.27%

19th percentile - higher than 19% of all known CVEs

Summary

The ManageWP Worker WordPress plugin before version 4.9.37 does not bind the account being logged in to the signature authorizing the login, nor prevent an already used login link from being replayed. Attackers who obtain such a link can gain a session as any user on the site, including an administrator.

Risk Assessment

Compromise of a login link can lead to full administrator account compromise and site takeover. Risk increases if links are intercepted or leaked.

Recommendation

Update the ManageWP Worker plugin to version 4.9.37 or later. Ensure login links are securely stored and not shared.

Other vulnerabilities in ManageWP Worker

CVE-2026-39463High
There is an unauthenticated Cross Site Scripting (XSS) vulnerability in ManageWP Worker versions <= 4.9.31. An attacker can exploit this flaw to inject malicious scripts in the user's context.

Original NVD description (English source)

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.