CVE-2026-19718CWE-287

CVE-2026-19718

High · published August 26, 2026

CVSS v3.1
8.1
EPSS
0%
Percentile
12.6
In the wild
Unconfirmed
What it is

The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.6th percentile
Weakness
CWE-287 · Improper Authentication
Published
2026-08-26T10:16Z
References (1)
https://wpscan.com/vulnerability/68892d43-912d-421f-9376-8dc6e2e906bc/ · [email protected]
EPSS history
Timeline
  • 27 AUG 06:20Z
    EPSS moved — → 0%
    epss
  • 26 AUG 06:00Z
    BlogVault, MalCare and WP Remote 5.16 - 6.62 - Unauthenticated Site Takeover via Connection Key Recovery
    cvelistv5