Blog Three WordPress auth-bypass bugs land together, only one patched
Three WordPress auth-bypass bugs land together, only one patched
Three unauthenticated authentication-bypass flaws in WordPress plugins were disclosed on the same day. Only User Profile Builder has shipped a fix; the other two remain open, alongside a critical file-deletion bug and two privilege-escalation flaws.
Three separate authentication-bypass flaws in WordPress plugins landed on the same day, all reachable without credentials, and only one of them has a patch to point to.
The one with the fix is user-profile-builder. CVE-2026-15368 covers a mistake in the automatic login the plugin performs after a new account is registered: the session it hands out is not correctly bound to the account that was just created, so an unauthenticated visitor can end up logged in as an arbitrary existing user, administrators included. The catch is that the site has to be running a supported but non-default configuration for the bug to trigger, which will spare a lot of installs but not the ones that matter. Patched in 3.16.4.
The other two are worse and, at the time of writing, unpatched.
6storage-rentals registers its six_storage_create_wp_user() handler on wp_ajax_nopriv_* — the endpoint anyone on the internet can call — with no nonce, no capability check, no credential check, and no ownership check, and then obligingly calls wp_set_current_user() and wp_set_auth_cookie() for whichever user the request names. CVE-2026-15303, CVSS 9.8, affects everything up to and including 2.27.0. user-session-synchronizer reaches the same outcome from a different angle: its synchronize_session() runs on init for every request and takes an attacker-supplied ussync-key, ussync-token and ussync-ref as gospel, with no validation of any of them. CVE-2026-15341, also 9.8, affects everything up to 1.4.0. In both cases the practical result is an attacker choosing which account to log in as, without ever touching the login form.
Sitting next to those three is a fourth unauthenticated flaw in rapisafe, the Contact Form 7 upload add-on. CVE-2026-14484, CVSS 9.1, is arbitrary file deletion — the plugin’s handleAjaxRemoveUpload doesn’t validate the file path it receives, and the nonce it relies on is exposed in public-facing JavaScript, which makes the nonce a speed bump rather than a control. Deleting wp-config.php puts the site into the installer and the installer is what turns file deletion into remote code execution on plenty of hosts. Affects up to and including 1.0.4.
Two privilege-escalation bugs round out the day, both requiring an existing account rather than none at all. bloyal (up to 3.1.611.78, CVE-2026-15001) registers save_bloyal_configuration_data and save_bloyal_accesskeyverification_data as AJAX actions with neither capability nor nonce checks, and its bloyal_customer_auto_login trusts customer-supplied identifiers on faith. propovoice (up to 1.7.8, CVE-2026-15312) exposes a REST create() endpoint that takes a role parameter straight from the request without checking it against an allowlist and without a promote_users capability check on the caller.
The common thread across all six is the same one that comes up week after week: plugin authors reaching for wp_ajax_nopriv_*, init, or a REST route and then treating whatever the request hands them as trustworthy. The two unpatched criticals in particular are worth watching, because a public NVD entry describing exactly which handler to call is a starting kit for someone writing a scanner.
For sites that want a scanner and cleanup tool built for exactly this kind of plugin compromise, Segurium is available on the official directory at wordpress.org/plugins/segurium/.
Share this post
Tags: #wordpress , #plugin , #cve , #exploit