CVE-2026-18960

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API...

CVE-2026-18960

The Block User Account WordPress plugin is affected prior to version 2.0.1. The issue: the plugin does not enforce its account block on every authentication path, allowing a blocked user who has an application password created before the block to retain full role-level read and write access throu...