CVE-2026-75903

8.1High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

8.1High

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-287

Impact

Unauthenticated remote attackers can retrieve stored delegated-login credentials and take over administrator accounts. Attackers only need network access to the exposed WordPress site running on Nginx.

Root cause

The plugin's auto-generated Nginx server configuration protects the wrong directory path, leaving delegated-login pairing credential files publicly accessible.

Affected systems

Vulnity Security plugin for WordPress up to, and including, 1.4.3 on Nginx-based installations

CVSS v3.1 · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade the Vulnity Security plugin to version 1.4.4 or later. If patching immediately is not possible, manually update your Nginx configuration to restrict web access to the directory containing the delegated-login credential files and reload Nginx.

shell

$ wp plugin update vulnity

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-75903