Unauthenticated User Data Exposure in Backup & Security Plugins by BlogVault, MalCare, and WP Remote
CVE-2026-19718
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 26 August 2026
Badges
What is CVE-2026-19718?
Multiple WordPress plugins, specifically the BlogVault Backup & Staging Plugin, MalCare WordPress Security Plugin, and WP Remote Plugin, prior to version 6.65, are susceptible to a serious data exposure vulnerability. This arises from their failure to sufficiently restrict unauthenticated users from accessing sensitive data associated with the secret used for binding the site to its remote management service. Furthermore, these plugins utilize a weak pseudo-random number generator for the creation of this secret, which can allow attackers to recover the secret and potentially gain administrative control over the affected WordPress sites.
Affected Version(s)
BlogVault Backup & Staging 5.16 < 6.65
MalCare WordPress Security Plugin 5.16 < 6.65
The WP Remote WordPress Plugin 5.16 < 6.65
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
References
CVSS V3.1
Timeline
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved