CVE-2026-75903

8.1 Élevée

Publiée le 16/10/2026 à 10:17 · Modifiée le 16/10/2026 à 17:17 · Analyse NVD reportée · Source : security@wordfence.com

Description

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.

Traduire en français

Produits concernés

manuelgalan Vulnity Security

Scores CVSS

Version	Score	Source	Vecteur
3.1	8.1 Élevée	security@wordfence.com	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-287

Références

https://plugins.trac.wordpress.org/changeset/3719370/vulnity/trunk/includes/class-static-security.php
https://plugins.trac.wordpress.org/changeset?reponame=&new=3719373%40vulnity%2Ftags%2F1.4.4&old=3717813%40vulnity%2Ftags%2F1.4.3
https://www.wordfence.com/threat-intel/vulnerabilities/id/5574a52f-cec8-4f79-a3a7-5c13272e5e17?source=cve

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories