CVE-2026-13600
Received Received - Intake

Unauthenticated Admin Access in AutoNetTV Relay WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-13600
EUVD
EUVD-2026-55022

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
autonettv relay to 3.0.14 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The AutoNetTV Relay WordPress plugin before version 3.0.14 has an authentication bypass vulnerability. During a scheduled synchronization task, the plugin sets an administrator authentication cookie without checking user capabilities or authentication. If the task executes before the HTTP response completes on certain server setups, an unauthenticated attacker can trigger the task and receive the administrator's session cookie, gaining full admin access without credentials.

Detection Guidance

Check if the AutoNetTV Relay WordPress plugin version is below 3.0.14 by inspecting the plugin files or WordPress admin panel. Look for unauthorized administrator sessions or unexpected authentication cookies during scheduled sync tasks.

Impact Analysis

An attacker could exploit this to gain complete control of your WordPress site without needing login credentials. This could lead to website defacement, data theft, malware distribution, or unauthorized changes to site content and settings. The impact includes full administrative access, compromising all site functionality and data.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements for GDPR (data protection), HIPAA (health information security), and other regulations. Unauthorized admin access may result in unauthorized data exposure, processing, or modification, triggering regulatory penalties and legal consequences.

Mitigation Strategies

Immediately update the AutoNetTV Relay plugin to version 3.0.14 or later. Review server logs for suspicious activity related to administrator session cookies or plugin synchronization tasks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-13600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart