CVE-2026-18052 ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters
Attackers can gain administrator sessions by replaying unsigned auto-login links, bypassing authentication in the ManageWP Worker plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-18052?
CVE-2026-18052 is a high-severity authentication bypass vulnerability in Unknown ManageWP Worker, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.
Weakness: CWE-287
Which versions are affected by CVE-2026-18052?
How do I fix CVE-2026-18052?
No fix has been published for CVE-2026-18052 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-18052 being exploited?
There is no known exploitation of CVE-2026-18052 in the wild and no public exploit code.
Sources
Also known as GHSA-3mmr-x4g9-xv4w.