CVE-2026-18786: CheckView < 2.3.2 - Administrator Account Creation via REST API Authentication Bypass
The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CheckViewto a version that resolves this vulnerability.Fixed in 2.3.2 - Compensating control
Mitigate the issue until upgraded by preventing unauthenticated access to REST actions that require administrator capabilities (e.g., restrict exposure of the WordPress REST API endpoints via network controls/ACL/WAF) so attackers cannot perform REST actions such as creating administrator accounts.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18786?
The severity of CVE-2026-18786 is rated at 80, indicating a significant security risk.
How do I fix CVE-2026-18786?
To fix CVE-2026-18786, upgrade the CheckView WordPress plugin to version 2.3.2 or later.
What is CVE-2026-18786 about?
CVE-2026-18786 involves an authentication bypass in the CheckView WordPress plugin prior to version 2.3.2, allowing unauthorized account creation.
What versions of CheckView are affected by CVE-2026-18786?
All versions of the CheckView plugin before 2.3.2 are affected by CVE-2026-18786.
Who is impacted by CVE-2026-18786?
Users of the CheckView WordPress plugin before version 2.3.2 are impacted by CVE-2026-18786.