Executive brief
CheckView is a WordPress plugin that provides additional functionality for WordPress sites. A flaw in the plugin's REST API authentication filter allows unauthenticated attackers to bypass WordPress's nonce-based authentication protection by including a specific plugin marker in a request URL. An attacker can trick a logged-in administrator into clicking a malicious link to perform unauthorized actions such as creating new administrator accounts or modifying site settings.
Technical details
The vulnerability is an authentication bypass in the CheckView WordPress plugin's REST API authentication filter (CWE-287). The filter fails to restrict itself to CheckView's own API routes and instead unconditionally discards authentication errors for any request whose URI contains a CheckView-specific string (the plugin's REST namespace path). This allows an attacker to craft a malicious URL that targets WordPress's core REST API endpoints while including the CheckView marker, bypassing the nonce validation check. The attack requires social engineering to trick a logged-in administrator into opening the link, relying on the browser's default SameSite=Lax cookie policy to send the administrator's session cookie. An unauthenticated attacker can then perform any REST action available to administrators, including creating new admin accounts or modifying site settings. The vulnerability affects versions 2.0.29 through 2.3.1 and was fixed in version 2.3.2.
Affected products
- CheckView CheckView 2.0.29 to 2.3.1
Timeline
- 2026-08-07: disclosed
- 2026-08-10: patched: Fixed in version 2.3.2