CVE-2026-18960: WordPress Block User Account Auth Bypass

CVE-2026-18960 Overview

CVE-2026-18960 is an authentication bypass vulnerability in the Block User Account WordPress plugin before version 2.0.1. The plugin fails to enforce its account block across every authentication path. A blocked user who holds an application password created before the block can retain full role-level read and write access through the WordPress REST API.

The flaw maps to [CWE-287: Improper Authentication]. Site administrators relying on the plugin to revoke access will find that previously issued application passwords remain valid, undermining the intended containment control.

Critical Impact
Blocked WordPress users retain role-level REST API access via pre-existing application passwords, defeating the plugin's core enforcement mechanism.

Affected Products

Block User Account WordPress plugin versions prior to 2.0.1
WordPress sites using application passwords with the affected plugin
Any WordPress deployment relying on this plugin for account revocation

Discovery Timeline

2026-08-10 - CVE-2026-18960 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-18960

Vulnerability Analysis

The Block User Account plugin adds an administrative control to prevent a user from authenticating to WordPress. The plugin hooks into the standard interactive login flow but does not cover the application password authentication path used by the REST API.

WordPress application passwords are long-lived credentials that authenticate API requests independently of the interactive login. When an administrator blocks a user, the plugin marks the account as blocked but does not invalidate or reject requests bearing an existing application password. The blocked user continues to authenticate through the REST API with the same capabilities their WordPress role grants.

This results in a partial confidentiality and integrity breach. The attacker retains the ability to read and modify content at the level of their assigned role, including posts, media, users, or settings where the role permits.

Root Cause

The plugin enforces blocking only on selected authentication filters rather than on every authentication path WordPress exposes. Application password authentication runs through a distinct filter chain that the plugin does not intercept before version 2.0.1.

Attack Vector

Exploitation requires that the target user previously created an application password and that the administrator subsequently blocks the account. The attacker sends REST API requests to endpoints such as /wp-json/wp/v2/posts using HTTP Basic authentication with the user's username and application password. The requests succeed and return or modify data according to the role's capabilities.

No user interaction is required, and the request can originate from any network location that can reach the WordPress site. Refer to the WPScan Vulnerability Report for further technical detail.

Detection Methods for CVE-2026-18960

Indicators of Compromise

REST API requests to /wp-json/* endpoints authenticated with HTTP Basic credentials belonging to a user marked as blocked in the site's user metadata.
Successful wp_authenticate_application_password events in WordPress logs for accounts that should be denied access.
Content changes, user modifications, or media uploads attributed to a blocked user account after the block timestamp.

Detection Strategies

Audit the wp_user_application_passwords user meta table to enumerate all users holding application passwords and cross-reference against currently blocked accounts.
Enable WordPress authentication logging and alert on any successful application password authentication where the user record contains the plugin's block flag.
Monitor web server access logs for Authorization: Basic headers on /wp-json/ routes tied to blocked usernames.

Monitoring Recommendations

Forward WordPress authentication events and REST API access logs to a centralized SIEM for correlation with account state changes.
Alert on any write operation, such as POST, PUT, PATCH, or DELETE, against /wp-json/wp/v2/ routes performed by accounts that were blocked within the previous 30 days.
Track creation and use of application passwords as a distinct authentication event stream separate from interactive logins.

How to Mitigate CVE-2026-18960

Immediate Actions Required

Update the Block User Account plugin to version 2.0.1 or later on all WordPress installations.
Revoke all application passwords held by any user account that is currently blocked or has been blocked in the past.
Review REST API activity logs for actions taken by blocked accounts and roll back unauthorized changes.

Patch Information

The vendor addressed the issue in Block User Account version 2.0.1 by extending the block enforcement to the application password authentication path. Administrators should upgrade through the WordPress plugin dashboard or by replacing the plugin files with the fixed release. See the WPScan Vulnerability Report for advisory details.

Workarounds

Manually revoke application passwords for a user immediately before or after applying the account block through the WordPress user profile screen.
Disable application passwords site-wide by returning false from the wp_is_application_passwords_available filter until the plugin is updated.
Restrict /wp-json/ access at the web server or WAF layer for user accounts that have been blocked.

bash

# Disable application passwords site-wide via mu-plugin until patched
# Save as wp-content/mu-plugins/disable-app-passwords.php
<?php
add_filter( 'wp_is_application_passwords_available', '__return_false' );