CVE-2026-75903 Vulnity Security <= 1.4.3 - Unauthenticated Authentication Bypass to Administrator via Exposed Pairing Credentials
Unauthenticated attackers can bypass authentication and gain administrator access by exploiting exposed pairing credentials in Nginx configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-75903?
CVE-2026-75903 is a high-severity authentication bypass vulnerability in manuelgalan Vulnity Security, published on 16 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.
Weakness: CWE-287
Which versions are affected by CVE-2026-75903?
How do I fix CVE-2026-75903?
No fix has been published for CVE-2026-75903 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-75903 being exploited?
There is no known exploitation of CVE-2026-75903 in the wild and no public exploit code.
Sources
Also known as GHSA-cpp4-39xq-w89m.