CVE-2026-95600: TrustedLogin Connector Data Exposure Flaw

CVE-2026-95600 is an unauthenticated sensitive data exposure vulnerability in TrustedLogin Connector versions 2.0.3 and earlier that allows attackers to access confidential information without authentication. This article covers technical details, affected versions, security impact, and recommended mitigation strategies.

CVE-2026-95600 Overview

CVE-2026-95600 is an unauthenticated sensitive data exposure vulnerability affecting the TrustedLogin Connector WordPress plugin in versions 2.0.3 and earlier. The flaw allows remote attackers to access sensitive information without authentication over the network. The issue is categorized under [CWE-497], which covers exposure of sensitive system information to an unauthorized control sphere. Since TrustedLogin Connector brokers support access to WordPress sites, exposed configuration data can weaken the trust boundary between site owners and support vendors.

Critical Impact
Unauthenticated remote attackers can retrieve sensitive plugin data from vulnerable TrustedLogin Connector installations without user interaction.

Affected Products

TrustedLogin Connector plugin for WordPress, versions <= 2.0.3
WordPress sites running the affected plugin versions
Support workflows relying on TrustedLogin Connector for delegated access

Discovery Timeline

2026-09-23 - CVE-2026-95600 published to the National Vulnerability Database (NVD)
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95600

Vulnerability Analysis

The vulnerability exists in the TrustedLogin Connector plugin, which enables WordPress site owners to grant temporary, time-boxed access to support vendors. Versions up to and including 2.0.3 expose sensitive data to unauthenticated network requests. An attacker can reach the affected endpoint without credentials and without user interaction. The impact is limited to confidentiality, with no direct integrity or availability effect according to the CVSS vector.

Because TrustedLogin manages support access tokens and configuration, exposed data may reveal information useful for reconnaissance or follow-on attacks. See the Patchstack Vulnerability Report for vendor-provided technical details.

Root Cause

The root cause is exposure of sensitive system information to an unauthorized actor, tracked under [CWE-497]. The plugin fails to enforce access controls or authentication on a resource that returns sensitive data. As a result, any network-reachable client can request the resource and receive information intended only for administrators or authorized support agents.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker sends an HTTP request to the vulnerable endpoint exposed by the TrustedLogin Connector plugin on a target WordPress site. The server responds with sensitive plugin data. No authentication is required, and the request pattern is trivial to automate at scale against WordPress installations.

No verified proof-of-concept code is available. Refer to the Patchstack advisory for additional technical context.

Detection Methods for CVE-2026-95600

Indicators of Compromise

Unauthenticated HTTP requests to TrustedLogin Connector plugin paths under /wp-content/plugins/trustedlogin-connector/ or associated REST routes.
Repeated anonymous requests from a single source enumerating plugin endpoints on WordPress sites.
Web server access logs showing 200 OK responses to unauthenticated requests that return non-trivial response bodies from the plugin.

Detection Strategies

Inventory WordPress sites and identify installations of TrustedLogin Connector at version 2.0.3 or earlier.
Correlate web access logs with plugin-related URIs to identify anonymous requests returning sensitive data.
Alert on outbound requests from reconnaissance tooling that fingerprints WordPress plugins and versions.

Monitoring Recommendations

Enable request logging on WordPress front-end web servers and forward logs to a central analytics platform.
Monitor administrative endpoints and REST API routes for unauthenticated access patterns.
Track plugin version drift so vulnerable releases are flagged automatically after each site update cycle.

How to Mitigate CVE-2026-95600

Immediate Actions Required

Upgrade TrustedLogin Connector to a version later than 2.0.3 on all WordPress sites.
Audit existing support access sessions and revoke any that cannot be verified as legitimate.
Review web server logs for prior unauthenticated access to plugin endpoints and investigate any anomalies.

Patch Information

Refer to the Patchstack Vulnerability Report for the fixed version and vendor guidance. Apply the vendor-supplied update through the WordPress plugin manager or via automated update tooling.

Workarounds

Restrict network access to the WordPress admin surface and plugin endpoints using a web application firewall (WAF) rule.
Temporarily deactivate the TrustedLogin Connector plugin on sites that cannot be updated immediately.
Limit access to WordPress sites by source IP where support workflows allow it, until patching is complete.

bash

# Example WP-CLI commands to inventory and update the plugin
wp plugin get trustedlogin-connector --field=version
wp plugin update trustedlogin-connector