CVE-2026-3718: ManageWP Worker Plugin XSS Vulnerability

CVE-2026-3718 Overview

CVE-2026-3718 is a Stored Cross-Site Scripting (XSS) vulnerability in the ManageWP Worker plugin for WordPress. The flaw affects all plugin versions up to and including 4.9.31. Attackers exploit the MWP-Key-Name HTTP request header, which the plugin processes without adequate input sanitization or output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when an administrator visits the plugin's connection management page with debug parameters enabled. The vulnerability is tracked under CWE-79 and is documented in the Wordfence Vulnerability Report.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in administrator browsers, enabling session theft, privilege abuse, and full WordPress site compromise.

Affected Products

ManageWP Worker plugin for WordPress, versions up to and including 4.9.31
WordPress sites using ManageWP for remote management
Administrator accounts accessing the plugin's connection management page with debug parameters

Discovery Timeline

2026-05-14 - CVE-2026-3718 published to NVD
2026-05-14 - Last updated in NVD database

Technical Details for CVE-2026-3718

Vulnerability Analysis

The vulnerability resides in how the ManageWP Worker plugin processes the MWP-Key-Name HTTP request header. The plugin stores the header value and later renders it on the connection management page without applying sufficient sanitization or output escaping. When an administrator visits this page with debug parameters present, the stored payload executes in the browser context of the WordPress site.

Because exploitation requires no authentication, any remote attacker can deliver the payload by sending a crafted HTTP request to the target site. The injected script runs with the privileges of the administrator viewing the page, making this a high-impact persistence vector for attackers targeting managed WordPress fleets.

Root Cause

The root cause is improper neutralization of input during web page generation, classified as CWE-79. The plugin trusts the MWP-Key-Name header as a key identifier without filtering HTML, JavaScript, or attribute-breaking characters. Output rendered into the debug-aware connection management view inherits this unfiltered content, allowing script execution in the admin's session.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction beyond an administrator visiting the affected page. An attacker sends an HTTP request with a malicious payload in the MWP-Key-Name header. The plugin stores this value, and when an administrator later loads the connection management page with debug parameters, the script triggers. Because of the scope change from the attacker's request context to the administrator's browser session, the attacker effectively pivots to administrator-level actions: creating accounts, modifying content, or exfiltrating data.

No verified proof-of-concept code is currently published. Technical details are available in the WordPress Changeset Update and the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-3718

Indicators of Compromise

HTTP requests containing non-standard or script-bearing values in the MWP-Key-Name header, such as content with <script>, onerror=, or javascript: substrings
Unexpected administrator account creation, plugin installation, or option changes on WordPress sites running ManageWP Worker
Outbound requests from administrator browser sessions to unknown domains shortly after loading the ManageWP connection page

Detection Strategies

Inspect web server access logs and WAF telemetry for inbound requests carrying the MWP-Key-Name header, especially with HTML or JavaScript metacharacters
Audit WordPress activity logs for administrative actions originating immediately after a visit to the plugin's connection management page
Compare installed ManageWP Worker plugin versions across the fleet against version 4.9.31 and earlier to identify exposed instances

Monitoring Recommendations

Enable HTTP header logging on perimeter proxies and WAFs to retain full MWP-Key-Name values for forensic review
Alert on anomalous WordPress admin session behavior, such as new user creation or plugin uploads from existing admin sessions
Continuously monitor plugin inventories and apply automated alerts when vulnerable versions are detected

How to Mitigate CVE-2026-3718

Immediate Actions Required

Update the ManageWP Worker plugin to a version newer than 4.9.31 on every WordPress site in the environment
Disable any debug parameters or developer modes on production WordPress installations
Review administrator accounts and recent privileged actions for signs of unauthorized changes

Patch Information

The maintainers addressed the vulnerability in a plugin update tracked in the WordPress Changeset 3485733. The fix introduces proper sanitization and output escaping for the MWP-Key-Name header value before it is rendered in the connection management view. Administrators should apply the latest plugin version available through the WordPress plugin repository.

Workarounds

Deploy a Web Application Firewall (WAF) rule that strips or blocks requests containing HTML or script characters in the MWP-Key-Name header
Restrict access to the WordPress admin area by IP allowlist until the plugin is updated
Temporarily deactivate the ManageWP Worker plugin on sites where immediate patching is not feasible

bash

# Example WAF rule to block script payloads in the MWP-Key-Name header (ModSecurity syntax)
SecRule REQUEST_HEADERS:MWP-Key-Name "@rx (?i)(<script|onerror=|javascript:|<svg|<img)" \
    "id:1002026,phase:1,deny,status:403,log,msg:'CVE-2026-3718 ManageWP Worker XSS attempt'"