CVE-2026-18960
Received Received - Intake

Blocked User Authentication Bypass via REST API in Block User Account WordPress Plugin

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: WPScan

Description
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-18960
EUVD
EUVD-2026-55011

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Block User Account WordPress plugin before version 2.0.1 has a flaw where it does not block accounts on all authentication paths. This allows a blocked user with an application password created before the block to still access the system with full read and write permissions through the REST API.

Detection Guidance

Check if the Block User Account WordPress plugin is installed and its version is below 2.0.1. Review user accounts with application passwords created before any block was enforced. Test REST API access for blocked users with application passwords to verify unauthorized access.

Impact Analysis

If you use the Block User Account plugin before version 2.0.1, a blocked user could retain unauthorized access to your WordPress site. This could lead to data breaches, unauthorized changes, or other malicious activities through the REST API.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by allowing unauthorized access to user data through the REST API. Blocked users with application passwords might retain read and write access, violating data integrity and access control requirements under these regulations.

Mitigation Strategies

Update the Block User Account plugin to version 2.0.1 or later immediately. Revoke and recreate application passwords for all users, especially those previously blocked. Monitor REST API access logs for suspicious activity from blocked users.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18960. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart