CVE-2026-18052: ManageWP Worker < 4.9.37 - Unauthenticated Authentication Bypass via Unsigned Auto-Login Parameters
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to obtain a ManageWP Worker auto-login link. Once they have one, the vulnerable plugin does not bind the signed authorization to a specific account, allowing the attacker to obtain a session as any site user, including an administrator.
Can an auto-login link be reused?
Yes. Affected versions do not prevent replay of an already used login link, so a captured link may be used again.
Which versions are affected?
ManageWP Worker versions before 4.9.37 are affected. Updating to 4.9.37 or later removes the vulnerable version range described here.