CVE-2026-75903
Received Received - Intake

Authentication Bypass in Vulnity Security WordPress Plugin

Publication date: 2026-10-16

Last updated on: 2026-10-16

Assigner: Wordfence

Description
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-16
Last Modified
2026-10-16
Generated
2026-10-16
AI Q&A
2026-10-16
EPSS Evaluated
N/A
NVD
CVE-2026-75903
EUVD
EUVD-2026-102815

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
manuelgalan Vulnity Security 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Vulnity Security plugin for WordPress has an authentication bypass vulnerability in versions up to 1.4.3. This flaw occurs because the plugin's server configuration on Nginx-based installations incorrectly protects the delegated-login credential file. Attackers can access this file to retrieve stored credentials and forge signed REST API requests, allowing them to log in as administrators without authentication.

Detection Guidance

Check for unauthorized access to the delegated-login credential file in the Vulnity Security plugin directory. Inspect Nginx configuration for incorrect path protection in the plugin's server snippet. Look for unusual REST API requests or admin login attempts from unexpected sources.

Impact Analysis

This vulnerability allows unauthenticated attackers to gain administrator-level access to your WordPress site. They can steal credentials, take control of the site, and perform unauthorized actions such as modifying content, installing malware, or stealing sensitive data.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating compliance requirements under GDPR and HIPAA. It may result in legal penalties, loss of trust, and reputational damage due to compromised user data or protected health information.

Mitigation Strategies

Update the Vulnity Security plugin to the latest version beyond 1.4.3. Review and correct Nginx configuration to protect the correct credential file path. Monitor admin accounts for unauthorized access and revoke any suspicious sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75903. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart