Session Hijacking in ManageWP Worker Plugin for WordPress
CVE-2026-18052
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 22 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18052?
The ManageWP Worker plugin for WordPress has a vulnerability that allows attackers to bypass authentication processes. This is due to the plugin failing to bind the account being logged into with the authorization signature, which can lead to session hijacking. If an attacker gains access to a previously used login link, they can exploit this flaw to acquire a session as any user, including administrators, effectively compromising the site's security.
Affected Version(s)
ManageWP Worker 0 < 4.9.37
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.