CVE-2026-18786— CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass

CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass

The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.

N/A

N/A

WordPress CheckView – Form & Checkout Testing 安全漏洞

WordPress CheckView – Form & Checkout Testing是WordPress基金会的一款表单与结账流程测试工具。 WordPress CheckView – Form & Checkout Testing 2.3.2之前版本存在安全漏洞，该漏洞源于REST API身份验证过滤器未限制到自身路由且无条件丢弃认证错误，可能导致未经身份验证的攻击者通过特制链接绕过REST nonce检查并执行管理员操作，例如创建新的管理员账户。

N/A

N/A