ManageWP Worker, CVE-2026-18052

CVE, Research URL: CVE-2026-18052
Home page URL: Security reports for ManageWP Worker
Application: ManageWP Worker
Published on: Aug 22, 2026
Research Description: The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.
Affected versions: max 4.9.37.
Status: vulnerable