CVE-2026-18786: CheckView WordPress Auth Bypass Flaw

CVE-2026-18786 Overview

CVE-2026-18786 affects the CheckView WordPress plugin in versions prior to 2.3.2. The plugin registers a REST API authentication filter that is not restricted to its own routes. It also unconditionally discards any authentication error raised when a request URI contains a CheckView-specific string. Unauthenticated attackers can bypass the REST nonce check and invoke any REST action available to an administrator. Exploitation requires tricking a logged-in administrator into opening a crafted link. Successful attacks allow adversaries to create new administrator accounts and take over the WordPress site. The flaw is tracked under CWE-287: Improper Authentication.

Critical Impact
Unauthenticated attackers can escalate to full WordPress administrator control by luring an authenticated admin to a crafted URL.

Affected Products

CheckView WordPress plugin versions before 2.3.2
WordPress sites with the CheckView plugin installed and active
Administrator accounts on sites running vulnerable CheckView versions

Discovery Timeline

2026-08-10 - CVE-2026-18786 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18786

Vulnerability Analysis

The CheckView plugin registers a filter on WordPress REST API authentication. The filter is intended to allow the plugin's own endpoints to skip the standard nonce check. Instead of scoping the filter to CheckView routes only, the plugin applies it globally. The filter then inspects the request URI for a CheckView-specific substring and, when found, discards the authentication error unconditionally. This allows any REST request whose URI contains that substring to bypass nonce validation and inherit the caller's session context.

When an authenticated administrator loads a crafted link, the browser issues the REST request with the admin's cookies attached. Because the nonce error is discarded, WordPress treats the request as authorized and executes any privileged action the administrator can perform. Attackers commonly abuse this to invoke POST /wp-json/wp/v2/users and create a new administrator account.

Root Cause

The root cause is an over-broad REST authentication filter combined with unconditional suppression of authentication errors. The plugin fails to verify that the request targets a CheckView route before waiving the nonce check. It also fails to require an explicit capability check on the endpoint invoked.

Attack Vector

The attack is network-based and requires user interaction. An attacker crafts a URL that triggers a REST API request containing the CheckView-specific string in its URI. The attacker delivers the link through phishing, a comment, or a third-party site. When a logged-in administrator opens the link, the browser executes the request against the administrator's own site with valid session cookies, and the plugin waives the nonce check.

The exploitation pattern is documented in the WPScan vulnerability report.

Detection Methods for CVE-2026-18786

Indicators of Compromise

New WordPress administrator accounts created without a corresponding audit trail from a legitimate admin session.
REST API requests to /wp-json/ endpoints where the URI contains the CheckView-specific string but the target route belongs to WordPress core or another plugin.
HTTP referers pointing to external domains immediately preceding privileged REST calls from an administrator's browser.

Detection Strategies

Alert on POST and PUT requests to /wp-json/wp/v2/users originating from administrator sessions with cross-origin referers.
Correlate WordPress user_register and set_user_role events with the source IP and user agent of the parent HTTP request.
Flag any REST request where the path does not match a CheckView route but the query string or URI contains CheckView-specific tokens.

Monitoring Recommendations

Enable WordPress audit logging for user creation, role changes, and plugin configuration modifications.
Forward web server access logs to a centralized analytics platform and retain full URIs for REST API endpoints.
Monitor outbound requests from administrator browsers to newly registered or low-reputation domains that could host crafted links.

How to Mitigate CVE-2026-18786

Immediate Actions Required

Update the CheckView WordPress plugin to version 2.3.2 or later on all affected sites.
Audit the wp_users table and remove any administrator accounts that cannot be attributed to a legitimate administrator.
Rotate credentials and application passwords for all administrator accounts on affected sites.

Patch Information

The vendor addressed the issue in CheckView version 2.3.2. The fix restricts the REST authentication filter to CheckView's own routes and stops discarding authentication errors for unrelated endpoints. Refer to the WPScan vulnerability report for release details.

Workarounds

Deactivate and remove the CheckView plugin until the site can be updated to version 2.3.2 or later.
Restrict administrator access to the WordPress dashboard using IP allow-lists or a VPN to reduce exposure to phishing-delivered links.
Deploy a web application firewall rule that blocks REST API requests whose URIs contain CheckView-specific strings but target non-CheckView routes.

bash

# Example WAF rule concept (ModSecurity-style pseudo-syntax)
SecRule REQUEST_URI "@rx /wp-json/(?!checkview/)" \
  "chain,deny,status:403,id:1002026018786,\
  msg:'CVE-2026-18786 CheckView REST bypass attempt'"
  SecRule REQUEST_URI "@contains checkview" "t:lowercase"