CVE-2026-13600: AutoNetTV Relay Auth Bypass Vulnerability

CVE-2026-13600 Overview

CVE-2026-13600 is an authentication bypass vulnerability in the AutoNetTV Relay WordPress plugin before version 3.0.14. The plugin sets a WordPress administrator authentication cookie during its scheduled content-synchronization task without performing any capability or authentication check. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie. This grants attackers full administrator access to the WordPress site without providing credentials. The flaw is classified under CWE-287 Improper Authentication.

Critical Impact
Unauthenticated attackers can obtain WordPress administrator session cookies by triggering the plugin's scheduled task, resulting in full site takeover.

Affected Products

AutoNetTV Relay WordPress plugin versions before 3.0.14
WordPress installations running the vulnerable plugin
Server configurations where scheduled tasks execute before HTTP response commit

Discovery Timeline

2026-08-10 - CVE-2026-13600 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-13600

Vulnerability Analysis

The AutoNetTV Relay plugin exposes a scheduled content-synchronization task that runs through the WordPress cron system. The task sets an administrator authentication cookie as part of its normal execution flow. The plugin does not verify the caller's capability or authentication status before issuing this cookie.

WordPress cron tasks can be triggered by any unauthenticated visitor who accesses wp-cron.php when a task is due. When the scheduled sync task fires within the same request lifecycle, the response returned to the triggering client contains a Set-Cookie header carrying the administrator's session token. The attacker replays this cookie to authenticate as the administrator.

Exploitability depends on server configuration. The task must execute before the HTTP response is committed, which occurs on setups where WordPress runs cron inline with the triggering request rather than through an external scheduler.

Root Cause

The root cause is a missing capability and authentication check in the scheduled task handler. The plugin logic that mints the administrator authentication cookie treats the cron context as trusted. It does not distinguish between an authorized administrator running the task and an unauthenticated visitor triggering it through wp-cron.php.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the target WordPress site that causes the due scheduled task to execute. On vulnerable configurations, the response contains the administrator authentication cookie. The attacker extracts the cookie value and uses it to access /wp-admin/ as the administrator. No user interaction is required and no credentials are needed. Attack complexity is high because success depends on the server's cron execution model and request timing.

Detection Methods for CVE-2026-13600

Indicators of Compromise

Unexpected Set-Cookie headers containing wordpress_logged_in_ values in responses to unauthenticated requests
Anonymous requests to wp-cron.php immediately followed by administrator-authenticated sessions from the same source IP
Creation of new administrator accounts or modification of privileged users without corresponding legitimate admin login events
Installation of unknown plugins or themes following anomalous cron trigger activity

Detection Strategies

Monitor web server logs for unauthenticated requests to wp-cron.php followed by successful requests to /wp-admin/ paths from the same client
Alert on responses to unauthenticated endpoints that include WordPress authentication cookies in Set-Cookie headers
Correlate WordPress user activity logs against authentication events to identify sessions with no matching login

Monitoring Recommendations

Enable and review WordPress audit logging for administrator actions including user creation, plugin installation, and settings changes
Track outbound requests initiated by the WordPress host that could indicate post-compromise activity
Baseline normal cron trigger patterns and alert on anomalous request rates against wp-cron.php

How to Mitigate CVE-2026-13600

Immediate Actions Required

Upgrade the AutoNetTV Relay plugin to version 3.0.14 or later on all affected WordPress installations
Rotate all administrator credentials and force logout of active sessions after upgrading
Audit administrator accounts, plugins, and themes for unauthorized additions or modifications
Review web access logs for prior exploitation attempts matching the indicators listed above

Patch Information

The vendor addressed the vulnerability in AutoNetTV Relay version 3.0.14 by adding capability and authentication checks before setting the administrator authentication cookie in the scheduled task. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

Disable the AutoNetTV Relay plugin until it can be updated to version 3.0.14 or later
Disable WordPress internal cron by setting DISABLE_WP_CRON to true in wp-config.php and configure a server-side cron job to invoke wp-cron.php through an authenticated or restricted channel
Restrict access to wp-cron.php at the web server or WAF layer to trusted IP addresses only

bash

# Disable WordPress internal cron and restrict wp-cron.php access
# Add to wp-config.php:
define('DISABLE_WP_CRON', true);

# Example nginx location block restricting wp-cron.php:
location = /wp-cron.php {
    allow 127.0.0.1;
    deny all;
}

# Server-side cron entry (crontab):
*/15 * * * * curl -s http://127.0.0.1/wp-cron.php > /dev/null 2>&1