Blog ManageWP Worker 4.9.37 closes a login-replay hole on 1,000,000 sites
ManageWP Worker 4.9.37 closes a login-replay hole on 1,000,000 sites
ManageWP Worker fixes a signed login link anyone can replay to become admin. Four more plugins ship patches that let unauthenticated or low-level users become admin too.
The pattern across these patches is one bug written five different ways. A visitor sends the email of an existing admin and gets signed in as that account. A signed login link works for anyone who obtains it. A multisite setting flips from any sub-site. A stored setting runs JavaScript in an admin’s browser. The result is the same: someone who should not be admin ends up admin.
None of these need a stolen password. Most need no account at all. Four of the plugins run on more than 1.7 million sites between them. The fifth publishes no install count.
worker 4.9.37
The signed login link ManageWP uses to sign an operator into a site is not bound to the account it was issued for. Anyone who obtains a used link can replay it and get a session as any user on that site, the administrator included. No login page, no password prompt.
- CVE: CVE-2026-18052, CVSS 8.1
- Installed on ~1,000,000 sites
- Patched in
worker4.9.37 - Update, then check the users list for accounts you did not create, and end active sessions on the administrator account
WP Social Media Login 1.0.7
The plugin lets a visitor sign in with a social account. It then trusts the email address it is handed, without checking that the identity provider ever signed the user in. An unauthenticated attacker sends the email of any existing account — an administrator’s included — and is signed in as that user.
- CVE: CVE-2026-77000, CVSS 9.8
- No install count is published for this plugin
- Patched in 1.0.7
- Update, then review the users list and active sessions for anything unfamiliar
forminator 1.57.0.5
Forminator exposes a network-wide setting that its code does not restrict to the network administrator. An admin of a single site on a multisite install can flip that setting and run arbitrary code across every site on the network.
- CVE: CVE-2026-19221, CVSS 7.2
- Installed on ~600,000 sites
- Patched in
forminator1.57.0.5 - Multisite only. Update, then audit files across sub-sites for changes made from a sub-site admin account
ai-engine 3.6.1
AI Engine runs privileged user management calls without checking that the caller is authorised to act on the target account. An admin on a multisite sub-site can take any account on the network, including the network admin.
- CVE: CVE-2026-75796, CVSS 7.2
- Installed on ~100,000 sites
- Patched in
ai-engine3.6.1 - Multisite only. Update, then check network-admin accounts for password or email changes and unfamiliar sessions
slider-hero 9.1.3
Two of Slider Hero’s request handlers have no authorisation and no nonce checks. One of the settings it stores is written back to an admin page without escaping. An unauthenticated visitor plants JavaScript that runs the next time an administrator loads that page.
- CVE: CVE-2026-76789, CVSS 8.8
- Installed on ~3,000 sites
- Patched in
slider-hero9.1.3 - Update, then load the Slider Hero admin pages with the browser network tab open and watch for scripts loaded from domains you do not recognise
Cleaning up after a bug that gave someone admin is not about deleting a file. It is about finding every account, session and scheduled job that the attacker created while the door was open, and treating anything you did not create as theirs.
Tags: #wordpress , #plugin , #cve