Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used login link from being replayed, allowing attackers who obtain such a link to gain a session as any user on the site, including an administrator.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-22 | 2 | Disclosure2 |
| 2026-08-24 | 1 | Disclosure1 |
Login links without identity binding are replayable tokens, not auth. CVE-2026-18052 in ManageWP Worker. https://radar.offseq.com/threat/cve-2026-18052-cwe-287-improper-authentication-in-managewp-worker-08445d8d9fb49f79
Post summary
The text briefly discloses a vulnerability (CVE‑2026‑18052) in ManageWP Worker, noting that login links lack proper identity binding and are replayable tokens, classified as improper authentication.
CVE-2026-18052 The ManageWP Worker WordPress plugin before 4.9.37 does not bind the account being logged in to the signature which authorises the login, nor prevent an already used … https://www.cve.org/CVERecord?id=CVE-2026-18052
Post summary
The sentence announces a new ManageWP Worker WordPress plugin vulnerability (CVE‑2026‑18052), outlining a missing account–signature binding, but does not provide PoC, exploit, patch, or active exploitation details.
CVE-2026-18052 Session Hijacking in ManageWP Worker WordPress Plugin Bef... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-18052 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces CVE‑2026‑18052, a session hijacking flaw in the ManageWP Worker WordPress plugin, and links to a vulnerability detail page, without mentioning PoC, exploit, patch, or active exploitation.