Vulnerability · Published Oct 16, 2026 · Assigned by Wordfence
CVE-2026-75903Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
High 8.1
In plain English
A high-severity improper authentication in Vulnity Security from manuelgalan. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 44% of all known vulnerabilities).
Official description
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| manuelgalan | Vulnity Security | 0 – through 1.4.3 |
Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.wordfence.com/threat-intel/vulnerabilities/id/5574a52f-cec8-4f79-a3a7-5c13272e5e17?source=cve
- https://plugins.trac.wordpress.org/changeset?reponame=&new=3719373%40vulnity%2Ftags%2F1.4.4&old=3717813%40vulnity%2Ftags%2F1.4.3
- https://plugins.trac.wordpress.org/changeset/3719370/vulnity/trunk/includes/class-static-security.php