Description

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-22T06:16:15.647Z",
  "pubdate": "2026-08-22T06:16:15.647Z",
  "executiveSummary": "The ManageWP Worker WordPress plugin suffers from an authentication bypass vulnerability affecting versions prior to 4.9.37. The flaw arises from a failure to cryptographically bind the target user account to the authorization signature and a lack of nonce or replay protection for authentication tokens. This enables malicious actors who obtain a valid login link to impersonate any user on the targeted WordPress installation, including privileged accounts with administrative capabilities. The primary risk implication is full administrative account takeover and subsequent remote code execution or complete site compromise. Exploitation requires the attacker to intercept or otherwise obtain a legitimate authorization link generated by the plugin. No specialized attacker privileges are required beyond access to the replayable signature, and the attack vector is exposed over the network via standard HTTP communication channels.",
  "technicalDetails": "The vulnerability resides within the authentication mechanism of the ManageWP Worker WordPress plugin, specifically in how it processes signature-authorized login requests prior to version 4.9.37. The root cause of the flaw is twofold: first, the cryptographic signature utilized to authorize the login action fails to validate or bind the specific user account being logged into the signature payload; second, the implementation lacks state tracking or anti-replay mechanisms, such as single-use nonces or timestamp validation, allowing previously consumed authentication links to be utilized multiple times.\nThe attack flow proceeds as follows: an attacker intercepts or otherwise obtains a valid, previously generated login link containing the authorization signature used by the ManageWP service to authenticate administrators to the managed site. Because the signature does not cryptographically couple the intended recipient's user identifier or username to the authorization token, the signature remains universally valid for establishing sessions across different user contexts. Furthermore, because the application does not mark the login link as expired or invalidated after its initial use, the link can be arbitrarily replayed.\nUpon submitting the replayed or repurposed login link over the network, the vulnerable component processes the request without verifying whether the signature corresponds to the requested user account or if the token has already been redeemed. Consequently, the application instantiates an active authenticated session for the specified user. If the targeted account possesses administrative privileges, the attacker instantly gains unrestricted administrative access to the WordPress backend, permitting post-exploitation activities such as installing malicious plugins, modifying theme files, executing arbitrary PHP code, or establishing persistent backdoors within the environment. The affected component is network-exposed, requires no authentication from the attacker's perspective provided the signature is known, and allows unauthenticated horizontal or vertical privilege escalation depending on the target user supplied in the request."
}