What is GHSA-3mmr-x4g9-xv4w?

GHSA-3mmr-x4g9-xv4w is a security advisory published by GitHub Security Advisories with High severity. The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to...

Which CVE IDs does GHSA-3mmr-x4g9-xv4w cover?

GHSA-3mmr-x4g9-xv4w covers the following CVE IDs: CVE-2026-18052. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-3mmr-x4g9-xv4w?

GHSA-3mmr-x4g9-xv4w has a CVSS v3 base score of 8.1, published by GitHub Security Advisories.

GHSA-3mmr-x4g9-xv4wHighCVSS 8.1

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to...

Vendor

GitHub Security Advisories

Published

August 22, 2026

Last Modified

August 23, 2026

🔗 CVE IDs covered (1)

CVE-2026-18052 →

📋 Description

The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-18052
https://wpscan.com/vulnerability/e1e8c313-f7ea-4f3a-85c0-4f33dfe0710d
https://github.com/advisories/GHSA-3mmr-x4g9-xv4w