WordPress Plugin Vulnerability in Block User Account
CVE-2026-18960
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 10 August 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-18960?
The Block User Account plugin for WordPress, prior to version 2.0.1, fails to enforce block restrictions effectively across all authentication pathways. This shortcoming permits users who have previously set application passwords to bypass account blocks, thereby retaining access to their assigned roles through the REST API. As a result, unauthorized parties may exploit this vulnerability to manipulate or access restricted data, significantly compromising the security integrity of WordPress sites utilizing this plugin.
Affected Version(s)
Block User Account 0 < 2.0.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.