CVE-2026-42674: AAM Plugin Auth Bypass Vulnerability

CVE-2026-42674 Overview

CVE-2026-42674 is an authentication bypass by spoofing vulnerability in the Advanced Access Manager (AAM) plugin for WordPress. The flaw affects all versions up to and including 7.1.0. Attackers leverage URL encoding to spoof requests and bypass access control checks enforced by the plugin. The weakness maps to [CWE-290: Authentication Bypass by Spoofing] and is exploitable over the network without authentication or user interaction.

Critical Impact
Unauthenticated attackers can bypass access restrictions enforced by the Advanced Access Manager plugin, compromising the integrity of protected resources on affected WordPress sites.

Affected Products

Advanced Access Manager WordPress plugin versions through 7.1.0
WordPress sites using AAM for role-based access control
WordPress installations relying on AAM URL access restrictions

Discovery Timeline

2026-06-01 - CVE-2026-42674 published to the National Vulnerability Database
2026-06-01 - Last updated in NVD database

Technical Details for CVE-2026-42674

Vulnerability Analysis

The Advanced Access Manager plugin enforces access control rules against request URLs. The plugin compares incoming request paths against a list of restricted endpoints to decide whether the request should be served. The comparison logic does not normalize URL-encoded characters before matching. Attackers craft a URL containing percent-encoded representations of restricted path segments, and the plugin fails to recognize the encoded path as a protected resource.

The result is an authentication bypass. Requests that should require an authenticated session reach protected handlers because the access control layer treats the encoded URL as an unprotected path. The CWE-290 classification reflects the spoofing nature of the bypass — the attacker presents a request that appears benign to the security check but resolves to a protected resource at the application layer.

The vulnerability has integrity impact only. Attackers can invoke restricted actions, but the flaw does not directly expose confidential data or cause denial of service. The EPSS score is 0.039%, placing it in the 11.92 percentile for exploitation likelihood.

Root Cause

The root cause is inconsistent URL canonicalization between the access control layer and the request dispatcher. The plugin performs string matching on the raw request URI without decoding percent-encoded sequences. WordPress and PHP later decode the URI when routing the request, producing a mismatch between what the access check sees and what the handler ultimately processes.

Attack Vector

The attacker sends an HTTP request to a target WordPress site running AAM 7.1.0 or earlier. The request targets an endpoint normally restricted by AAM access rules. The attacker replaces one or more characters in the path with their percent-encoded equivalents — for example, encoding a forward slash as %2F or a letter as its %XX hexadecimal value. The AAM access check fails to match the encoded path against its rule set and permits the request. WordPress decodes the path and routes the request to the protected handler.

No authentication, privileges, or user interaction are required. Exploitation succeeds over the network against any reachable vulnerable installation.

Detection Methods for CVE-2026-42674

Indicators of Compromise

HTTP request logs containing percent-encoded characters in paths targeting AAM-protected endpoints, such as %2F, %2E, or encoded alphabetic characters
Successful HTTP 200 responses to unauthenticated requests for paths that AAM rules should restrict
Access to administrative or role-restricted URLs without a corresponding authenticated session cookie

Detection Strategies

Inspect web server access logs for unusual percent-encoding in request URIs that target endpoints governed by AAM rules
Correlate unauthenticated requests with subsequent privileged actions in WordPress audit logs
Deploy WAF rules that normalize URLs before matching them against access policies and flag requests where encoded and decoded forms diverge

Monitoring Recommendations

Monitor the AAM plugin version across all WordPress sites and alert on any instance at version 7.1.0 or earlier
Track 200-status responses to URIs containing unnecessary URL encoding originating from external IP addresses
Review WordPress user activity logs for actions performed without preceding authentication events

How to Mitigate CVE-2026-42674

Immediate Actions Required

Update the Advanced Access Manager plugin to a version later than 7.1.0 once the vendor releases a patched release
Audit AAM-protected endpoints for unauthorized access by reviewing web server and WordPress logs since plugin installation
Restrict administrative endpoints at the web server or WAF layer until the plugin update is applied

Patch Information

Refer to the Patchstack Vulnerability Report for the latest fixed version information and remediation guidance from the AAM maintainers.

Workarounds

Deploy a web application firewall rule that decodes request URIs and blocks requests where the decoded path targets AAM-restricted endpoints
Enforce access control at the web server level using .htaccess or Nginx location blocks that match canonicalized paths
Disable the Advanced Access Manager plugin and rely on WordPress native role checks until a fixed version is available