Quick answers
- Is CVE-2026-18052 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-18052 being exploited in the wild.
- How severe is CVE-2026-18052?
- High severity, with a CVSS score of 8.1, published 22 August 2026.
- Which products and versions are affected?
- ManageWP Worker before 4.9.37.
- Is there a fix for CVE-2026-18052?
- A patch was published on 2026-08-22: Fixed in version 4.9.37 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-18052 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-18052?
- Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authentication bypass stemming from improper signature validation in the auto-login mechanism. The plugin signs a message containing only the `mwp_goto` and `message_id` parameters, but not the `username` parameter—allowing an attacker to swap the username field while keeping the same valid signature. Additionally, in versions up to 4.9.35, the lack of a delimiter between signed fields enables replay attacks where a consumed auto-login URL can be regenerated with different message_id values. Exploitation requires the site to be connected to ManageWP (the normal state) and possession of a valid auto-login URL issued within the past 12 hours; no authentication, private key, or dashboard access is needed. An attacker can directly access WordPress admin functionality as any user, including administrators.
Affected products
- ManageWP Worker before 4.9.37
Timeline
- 2026-08-20: disclosed
- 2026-08-22: advisory
- 2026-08-22: patched: Fixed in version 4.9.37