Vulnerability · Published Aug 22, 2026 · Assigned by WPScan
CVE-2026-18052ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters
High 8.1
In plain English
A high-severity improper authentication in ManageWP Worker from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.4%top 68.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | ManageWP Worker | 0 – before 4.9.37 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/e1e8c313-f7ea-4f3a-85c0-4f33dfe0710d/ exploit, vdb-entry, technical-description