CVE-2026-18052

ManageWP Worker WordPress plugin versions before 4.9.37 contain an authentication bypass vulnerability. The plugin's auto-login mechanism does not bind the target account to the cryptographic signature that authorises the login, and does not prevent replay of an already-used login link. An attack...