{"id":"CVE-2026-75903","kind":"vulnerability","aliases":["CVE-2026-75903"],"related":[],"title":"Vulnity Security WordPress plugin: unauthenticated admin login via exposed credentials","description":"The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.","summary":"The Vulnity Security WordPress plugin up to and including 1.4.3 stores a delegated-login pairing credential file that its Nginx configuration snippet fails to protect. An unauthenticated attacker can fetch those credentials, forge signed REST API requests, and log in as an administrator.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["nginx","package","self-hosted","wordpress"],"not_affected_if":["non-nginx-server","plugin-not-installed"],"how_to_check":"- Check whether the Vulnity Security plugin is installed and its version is `1.4.3` or lower in the WordPress admin plugins list or `wp plugin list`\n- On Nginx hosts, check whether the plugin's generated server snippet is included in the site config and whether the pairing credential file is reachable over HTTP (unknown which exact file path the sources name)","fix":"- Update the Vulnity Security plugin to a version later than `1.4.3` (fixed version unknown from the sources)\n- If no fixed version exists, deactivate and remove the plugin\n- Rotate WordPress administrator passwords and any delegated-login pairing credentials, and review admin accounts for unknown users","status":"open","published_at":"2026-10-16T08:17:13+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","triaged_at":"2026-10-25T03:06:45+00:00","updated_at":"2026-10-25T03:06:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:06:45Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Vulnity Security plugin to a version later than `1.4.3` (fixed version unknown from the sources)\n- If no fixed version exists, deactivate and remove the plugin\n- Rotate WordPress administrator passwords and any delegated-login pairing credentials, and review admin accounts for unknown users","reach":"internet","title":"Vulnity Security WordPress plugin: unauthenticated admin login via exposed credentials","impact":"high","summary":"The Vulnity Security WordPress plugin up to and including 1.4.3 stores a delegated-login pairing credential file that its Nginx configuration snippet fails to protect. An unauthenticated attacker can fetch those credentials, forge signed REST API requests, and log in as an administrator.","category":"package","nicknames":[],"who_cares":["wordpress","nginx","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker logs in as WordPress administrator and takes over the site","analyst_note":"Find the fixed plugin version and the exact protected file path from the NVD entry or the vendor advisory.","how_to_check":"- Check whether the Vulnity Security plugin is installed and its version is `1.4.3` or lower in the WordPress admin plugins list or `wp plugin list`\n- On Nginx hosts, check whether the plugin's generated server snippet is included in the site config and whether the pairing credential file is reachable over HTTP (unknown which exact file path the sources name)","needs_analyst":true,"not_affected_if":["plugin-not-installed","non-nginx-server"],"who_is_affected":"Sites running the Vulnity Security WordPress plugin version 1.4.3 or earlier on Nginx, where the plugin's generated server configuration snippet is in use. Sites not running this plugin, or not on Nginx, are not described as affected by the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000679,"input_tokens":3368,"output_tokens":684,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-75903':13A,16A '1.4.3':32B,85C 'admin':6A 'administr':66B,140C 'api':59B,133C 'attack':51B,124C 'authent':76C 'base':103C 'bypass':77C 'configur':44B,111C 'credenti':10A,39B,55B,98C,129C 'cve':11A,14A 'deleg':36B,95C 'delegated-login':35B,94C 'directori':116C 'due':88C 'expos':9A 'fail':46B 'fetch':53B 'file':40B,99C 'forg':56B,130C 'generat':109C 'guard':113C 'host':21B 'includ':31B,84C 'instal':104C 'insuffici':90C 'log':62B,136C 'login':7A,37B,96C 'make':119C 'nginx':17B,43B,102C 'nginx-bas':101C 'packag':18B 'pair':38B,97C 'path':117C 'plugin':4A,27B,70C,107C 'possibl':121C 'protect':48B,91C 'request':60B,134C 'rest':58B,132C 'retriev':126C 'secur':2A,25B,69C 'self':20B 'self-host':19B 'server':110C 'sign':57B,131C 'snippet':45B,112C 'store':33B,128C 'unauthent':5A,50B,123C 'version':80C 'via':8A 'vulner':74C 'vulniti':1A,24B,68C 'wordpress':3A,22B,26B,72C 'wrong':115C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Vulnity Security WordPress plugin version 1.4.3 or earlier on Nginx, where the plugin's generated server configuration snippet is in use. Sites not running this plugin, or not on Nginx, are not described as affected by the sources.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-16T08:17:13+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-75903","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75903","severity":null,"published_at":"2026-10-16T08:17:13+00:00","modified_at":"2026-10-16T15:17:33+00:00","first_seen_at":"2026-10-23T21:57:12+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}