Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-75903— Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials

Quick assessment

Affected
manuelgalan Vulnity Security
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

WordPress 的 Vulnity Security 插件在所有 1.4.3 及更早版本中存在认证绕过漏洞。该问题源于在基于 Nginx 的安装环境中，对委托登录配对凭证文件的保护不足：插件生成的服务器配置片段错误地保护了目录路径。这使得未认证的攻击者能够获取存储的凭证、伪造签名的 REST API 请求，并以管理员身份登录。

CVSS 8.1 · High EPSS 0.50% · P42

Affected Version Matrix 1

VendorProduct Version RangeStatus
manuelgalan Vulnity Security ≤ 1.4.3 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-75903

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
Source: CVE Program / CVE List V5
Vulnerability Description
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
manuelgalan Vulnity Security 0 ~ 1.4.3 -

II. Public POCs for CVE-2026-75903

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-75903

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-75903 (1)

Vendor Pages for CVE-2026-75903 (1)

IV. Related Vulnerabilities

Same weakness: CWE-287

V. Comments for CVE-2026-75903

No comments yet

Leave a comment