CVE-2026-18052: ManageWP Worker Authentication Bypass

CVE-2026-18052 Overview

CVE-2026-18052 is an authentication bypass vulnerability in the ManageWP Worker WordPress plugin. The flaw affects all versions prior to 4.9.37. The plugin generates login links whose cryptographic signature does not bind to the target account. It also fails to invalidate previously used login links, permitting replay.

An attacker who obtains a valid login link can authenticate as any user on the site, including administrators. This grants full control of the affected WordPress installation. The weakness is categorized as improper authentication [CWE-287].

Critical Impact
Attackers who intercept or replay a ManageWP login link can gain administrator sessions on affected WordPress sites, resulting in full site compromise.

Affected Products

ManageWP Worker WordPress plugin versions prior to 4.9.37
WordPress sites managed through the ManageWP service using the vulnerable plugin
Any user role on the affected site, up to and including administrator accounts

Discovery Timeline

2026-08-22 - CVE-2026-18052 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-18052

Vulnerability Analysis

The ManageWP Worker plugin provides remote management capabilities for WordPress sites. Part of that functionality includes generating signed login links that let ManageWP administrators access the managed site without entering credentials.

Two distinct flaws combine to break the authentication model. First, the signature that authorizes the login is not bound to the specific account being logged in. Second, a login link that has already been used remains valid and can be replayed. Either flaw alone weakens the trust boundary; together they allow session forgery against arbitrary accounts.

Root Cause

The root cause is missing cryptographic binding between the signed authorization token and the target user identity. The signature validates that a login attempt was authorized, but it does not verify which user was intended. The plugin also lacks a nonce or single-use enforcement mechanism, so replay protection is absent. Both issues fall under improper authentication [CWE-287].

Attack Vector

Exploitation is network-based and requires no authentication or user interaction from the victim. An attacker who obtains a valid login link, whether through log exposure, referrer leakage, or interception, can submit the link and request a session for any username on the site. Administrator accounts are the highest-value target because they permit plugin installation, database access, and arbitrary PHP execution through the WordPress admin interface.

No public proof-of-concept code is available. Technical detail is documented in the WPScan Vulnerability Report.

Detection Methods for CVE-2026-18052

Indicators of Compromise

Unexpected administrator logins in WordPress authentication logs with no corresponding user activity beforehand.
Repeated requests to ManageWP Worker endpoints with the same signature parameter across different user contexts.
New administrator accounts, modified user roles, or newly installed plugins that were not initiated by legitimate operators.

Detection Strategies

Audit the wp_users and wp_usermeta tables for role changes and account creation events that do not correlate with legitimate administrative activity.
Review web server access logs for repeated hits to the ManageWP Worker plugin endpoint with matching query strings, which may indicate replay attempts.
Cross-reference successful WordPress logins with source IP addresses of the legitimate ManageWP service to identify anomalous origins.

Monitoring Recommendations

Enable WordPress audit logging plugins to record every authentication event with source IP, user agent, and target account.
Forward WordPress and web server logs to a centralized SIEM or data lake for correlation and long-term retention.
Alert on any administrator-level session established from an IP address not previously observed authenticating as an administrator.

How to Mitigate CVE-2026-18052

Immediate Actions Required

Update the ManageWP Worker plugin to version 4.9.37 or later on every managed WordPress site.
Rotate passwords and invalidate active sessions for all administrator accounts on sites that ran the vulnerable version.
Review recent administrator activity, installed plugins, and theme files for unauthorized modifications.

Patch Information

The vendor addressed the flaw in ManageWP Worker version 4.9.37. The fix binds the login signature to the specific account being authenticated and prevents reuse of a previously consumed login link. See the WPScan Vulnerability Report for advisory details.

Workarounds

Temporarily deactivate the ManageWP Worker plugin on sites that cannot be updated immediately.
Restrict access to the WordPress /wp-admin/ path and ManageWP Worker endpoints using web application firewall rules or IP allowlists.
Enforce multi-factor authentication for all WordPress administrator accounts to raise the cost of a successful session hijack.

bash

# Update ManageWP Worker via WP-CLI on affected sites
wp plugin update worker --version=4.9.37
wp plugin list --name=worker --fields=name,status,version