Authentication Bypass in AutoNetTV Relay Plugin for WordPress
CVE-2026-13600
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
What is CVE-2026-13600?
The AutoNetTV Relay plugin for WordPress, prior to version 3.0.14, contains a significant security flaw that allows unauthenticated attackers to retrieve an administrator's session cookie during scheduled content-synchronization tasks. This occurs because the plugin fails to implement necessary capability checks or authentication verification before setting the administrator authentication cookie. If the scheduled task is executed before the HTTP response is completed, an attacker can exploit this vulnerability to gain unauthorized administrator access, effectively compromising the integrity of the WordPress installation.
Affected Version(s)
AutoNetTV Relay 0 < 3.0.14
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.