Description

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-26T06:16:25.900Z",
  "pubdate": "2026-08-26T06:16:25.900Z",
  "executiveSummary": "A critical security vulnerability exists within BlogVault Backup & Staging, MalCare WordPress Security, and WP Remote WordPress plugins, all versions prior to 6.65.\nThe vulnerability involves the improper generation and exposure of a secret key used to bind the WordPress installation to remote management services.\nThe secret is generated using a cryptographically weak pseudo-random number generator (PRNG), making it susceptible to brute-force or prediction attacks.\nFurthermore, the plugins fail to implement adequate access controls, allowing unauthenticated remote attackers to retrieve data derived from this secret.\nBy recovering the secret, an unauthorized actor can impersonate the remote management service, facilitating full administrative takeover of the affected WordPress site.\nThe risk is severe, as it enables remote code execution or complete site compromise without requiring prior knowledge of legitimate administrator credentials.\nExploitation is possible over the network without authentication, significantly increasing the attack surface.",
  "technicalDetails": "The vulnerability stems from two primary cryptographic and logic failures within the affected plugins' binding mechanism. First, the secret token used to authenticate the site to the remote management service is derived via a weak pseudo-random number generator. This lack of entropy allows an attacker to predict or reconstruct the secret key if sufficient samples are collected or if the search space is limited by the PRNG's state constraints.\nSecond, the plugins expose derived data related to this secret to unauthenticated requests. An attacker can query the site's public-facing endpoints to retrieve information that facilitates the reconstruction of the master binding secret. Because the plugins do not enforce authentication checks for these specific API calls, an unauthenticated user can interact with the management protocol as if they were an authorized remote service.\nThe exploitation flow begins with the attacker identifying the target WordPress site running a vulnerable version of the affected plugins. The attacker targets the insecure endpoint responsible for management service communication. By sending specially crafted requests, the attacker extracts data derived from the weak secret. Using the predictable nature of the PRNG, the attacker performs cryptanalytic operations to resolve the master secret key.\nOnce the secret is successfully recovered, the attacker uses it to forge valid communication packets directed at the plugin's administrative API. This allows the attacker to bypass standard WordPress authentication mechanisms, as the plugin trusts the incoming request based solely on the compromised secret. The post-exploitation impact includes the ability to perform administrative actions such as installing malicious plugins, modifying site content, creating new administrator accounts, or executing arbitrary code on the underlying web server. This effectively grants the attacker full control over the WordPress instance.\nThe vulnerability affects BlogVault Backup & Staging, MalCare WordPress Security, and WP Remote WordPress plugins across all versions before 6.65. The lack of proper rate limiting on the discovery process and the fundamental weakness in entropy generation for the site-binding key constitute the primary failure points."
}