CVE-2026-18052
Received Received - Intake

ManageWP Worker Plugin Session Hijacking Vulnerability

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: WPScan

Description
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-18052
EUVD
EUVD-2026-64219

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
managewp worker to 4.9.37 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The ManageWP Worker WordPress plugin before version 4.9.37 has an authentication bypass flaw. It fails to bind the account being logged in to the signature that authorizes the login. This allows attackers who obtain a login link to gain unauthorized access to any user account, including administrators, by replaying the link.

Detection Guidance

Check the installed version of the ManageWP Worker plugin. If it is below 4.9.37, the system is vulnerable. Use commands like 'wp plugin list' in WordPress CLI or inspect the plugin files directly.

Impact Analysis

Attackers can exploit this to gain full control of any user account on the affected WordPress site, including admin accounts. This could lead to data theft, website defacement, malware injection, or complete site takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face fines or penalties for non-compliance due to data breaches resulting from this flaw.

Mitigation Strategies

Update the ManageWP Worker plugin to version 4.9.37 or later immediately. Disable the plugin temporarily if an update is not immediately available, and review user sessions for unauthorized access.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18052. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart