Executive brief
ManageWP Worker is a plugin that allows WordPress site administrators to delegate management tasks to a centralized dashboard. The plugin's auto-login feature fails to properly validate which account is being logged in, allowing attackers who obtain a valid login URL to impersonate any user, including administrators. This could lead to complete site compromise, data theft, or malicious modifications.
Technical details
The vulnerability is an authentication bypass stemming from improper signature validation in the auto-login mechanism. The plugin signs a message containing only the `mwp_goto` and `message_id` parameters, but not the `username` parameter—allowing an attacker to swap the username field while keeping the same valid signature. Additionally, in versions up to 4.9.35, the lack of a delimiter between signed fields enables replay attacks where a consumed auto-login URL can be regenerated with different message_id values. Exploitation requires the site to be connected to ManageWP (the normal state) and possession of a valid auto-login URL issued within the past 12 hours; no authentication, private key, or dashboard access is needed. An attacker can directly access WordPress admin functionality as any user, including administrators.
Affected products
- ManageWP Worker before 4.9.37
Timeline
- 2026-08-20: disclosed
- 2026-08-22: advisory
- 2026-08-22: patched: Fixed in version 4.9.37