Live › vulnerability › CVE-2026-75903
Go to dashboardThe Vulnity Security WordPress plugin up to and including 1.4.3 stores a delegated-login pairing credential file that its Nginx configuration snippet fails to protect. An unauthenticated attacker can fetch those credentials, forge signed REST API requests, and log in as an administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Vulnity Security WordPress plugin version 1.4.3 or earlier on Nginx, where the plugin's generated server configuration snippet is in use. Sites not running this plugin, or not on Nginx, are not described as affected by the sources.
No product ranges from the sources yet.
1.4.3 or lower in the WordPress admin plugins list or wp plugin list1.4.3 (fixed version unknown from the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.
This page as .md · .json · in your agent: get_signal("CVE-2026-75903")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.