Blog MalCare 6.65 fixes an unauthenticated takeover on 200,000 sites
MalCare 6.65 fixes an unauthenticated takeover on 200,000 sites
A weak random number generator in BlogVault, MalCare and WP Remote let attackers derive the secret that binds a site to the remote management service and log in as administrator. Version 6.65 rebuilds the secret. Around 200,000 sites run the affected code.
The biggest fix today ships from a plugin that most sites installed to be safer. BlogVault Backup & Staging, MalCare and WP Remote share the code that binds a site to their remote management service. On versions before 6.65, that code built its connection secret with a weak pseudo-random number generator. It also handed out data derived from the secret to anyone who asked. An unauthenticated attacker could recover the secret and log in as administrator. Around 200,000 sites run these plugins.
The rest of the day is mostly a lesson in reading version ranges. Three advisories name no fixed release, and for two of them the fix was already on the shelf: one of those shipped inside the version the advisory calls broken. The last item is a plugin with no directory presence and no patch.
malcare-security 6.65
The shape is an old one: a secret that should be unguessable, generated in a way that lets an attacker guess it. The affected code lives in the connection key that ties a site to the remote management service. Before 6.65, that key was built with a weak generator. Parts of the same key leaked to unauthenticated callers. From those two facts, an attacker could reconstruct the key and act as the site’s owner in the vendor’s console, which meant administrator access on the site itself.
Version 6.65 rebuilds the secret with the random_int function and reworks the key generation. The 6.65 changelog also mentions new file-editing hardening controls. The same fix ships in BlogVault Backup & Staging and in WP Remote at the same version number.
- Affected: BlogVault, MalCare and WP Remote before 6.65
- CVSS: 8.1
- CVE: CVE-2026-19718
- Patched in 6.65. The MalCare slug is now on 6.69 in the directory.
- Installed on ~200,000 sites for MalCare alone
- Update to 6.65 or later. On sites that ran an affected version, disconnect and reconnect the site from the vendor’s dashboard to rotate the key, and review the WordPress user list for new administrator accounts.
erp 1.17.8
The ERP plugin ships an IMAP connector for its CRM module. When the setting is on, a cron job reads mail from a configured mailbox and saves attachments to disk. The save_attachments() function does not check the file extension. It also does not normalise the path. An unauthenticated attacker sends an email with a forged References header that matches the plugin’s pattern. The attachment is named ../helper.php. The cron job writes that PHP file into wp-content/uploads/, outside the .htaccess-protected crm-attachments folder. On servers that run PHP inside uploads, this is remote code execution.
The bug needs both the CRM module and the IMAP Email Connect feature to be enabled and configured. A dropped PHP file in wp-content/uploads/ is exactly the kind of artefact a WordPress malware scanner is built to spot.
- Affected: versions before 1.17.8
- CVSS: 9.8
- CVE: CVE-2026-18080
- Fix: install 1.17.8 or later. The advisory lists 1.17.8 as broken, and it is not:
save_attachments()gained a filename sanitiser and a check that the resolved path stays inside the attachment directory, between 1.17.7 and 1.17.8. 1.17.9 does not touch that function. The trac changeset documents the code change. - Installed on ~5,000 sites
- If the CRM and IMAP feature is not in use, turn it off. Search
wp-content/uploads/for.phpfiles. Check the web server config for whether PHP executes underuploads/.
mangboard 2.3.8
Mang Board is a Korean bulletin-board plugin. The mbw_get_hash_key() function generates the HMAC that signs the plugin’s authentication cookie. When a WordPress user is already logged in, that function uses the logged-in user’s identity instead of the username inside the cookie. The check in mbw_validate_auth_cookie() accepts the mismatch. A subscriber-level account can build a cookie that names an administrator and pass validation. The attacker then changes the administrator password and takes the site.
- Affected: versions 2.3.7 and earlier
- CVSS: 8.8
- CVE: CVE-2026-75977
- Update to 2.3.8, the newest release in the directory.
mbw_get_hash_key()was rewritten in it. The 2.3.8 changelog mentions only pagination and CSS, so the fix ships unannounced. The plugin’s readme also numbers its own releases separately from the ones it publishes, which is why version numbers above 2.3.8 appear in it and nowhere in the directory. - Installed on ~8,000 sites
- The bug needs a subscriber account or higher. Review recent user registrations. If open registration is not needed on the site, turn it off.
order-tip-woo 1.6.0
Order Tip for WooCommerce exposes a delete_exported_csv_file_ajax handler for removing exported CSV files. The handler does not check the user’s capability. It also does not restrict which path the request may name. A user with the Shop Manager role or above can delete any file the web server can reach. Deleting wp-config.php drops the site into the setup wizard and lets an attacker rewire it to their own database.
- Affected: versions before 1.6.0
- CVSS: 8.7
- CVE: CVE-2026-77693
- Patched in 1.6.0 per the advisory
- Installed on ~200 sites
- Update and audit which staff accounts hold the Shop Manager role.
classified-listing-mobile-number-verification up to 1.6.0, unpatched
This add-on brings phone-number verification to the Classified Listing platform. When OTP login is on and Firebase is picked as the verification gateway, the process_otp_login() function does not check the OTP with Firebase. An unauthenticated attacker submits any OTP code and any UID. The plugin logs them in as the user whose phone number they supplied. Administrator takeover follows when an administrator has a phone number registered in the plugin’s phone table.
- Affected: up to and including 1.6.0
- CVSS: 8.1
- CVE: CVE-2026-15985
- The advisory names no fixed release.
- The plugin has no entry in the wordpress.org directory, so no install count is published.
- Until a fix arrives: switch the verification gateway away from Firebase, or disable OTP login. Remove phone numbers from administrator accounts inside the plugin’s phone table.
Tags: #wordpress , #plugin , #cve