---
id: "CVE-2026-75903"
kind: "vulnerability"
aliases: ["CVE-2026-75903"]
title: "Vulnity Security WordPress plugin: unauthenticated admin login via exposed credentials"
severity: "high"
cvss: 8.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["nginx", "package", "self-hosted", "wordpress"]
not_affected_if: ["non-nginx-server", "plugin-not-installed"]
published_at: "2026-10-16T08:17:13+00:00"
first_seen_at: "2026-10-23T21:57:12+00:00"
updated_at: "2026-10-25T03:06:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75903", "first_seen_at": "2026-10-23T21:57:12+00:00"}]
---

# Vulnity Security WordPress plugin: unauthenticated admin login via exposed credentials

The Vulnity Security WordPress plugin up to and including 1.4.3 stores a delegated-login pairing credential file that its Nginx configuration snippet fails to protect. An unauthenticated attacker can fetch those credentials, forge signed REST API requests, and log in as an administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Vulnity Security plugin is installed and its version is `1.4.3` or lower in the WordPress admin plugins list or `wp plugin list`
- On Nginx hosts, check whether the plugin's generated server snippet is included in the site config and whether the pairing credential file is reachable over HTTP (unknown which exact file path the sources name)

## Fix

- Update the Vulnity Security plugin to a version later than `1.4.3` (fixed version unknown from the sources)
- If no fixed version exists, deactivate and remove the plugin
- Rotate WordPress administrator passwords and any delegated-login pairing credentials, and review admin accounts for unknown users

## Timeline

- 2026-10-23T21:57:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-75903

## From the sources

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.4.3 This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations, where the plugin's generated server configuration snippet guards the wrong directory path. This makes it possible for unauthenticated attackers to retrieve the stored credentials, forge signed REST API requests, and log in as an administrator.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_