Authentication Bypass Vulnerability in Vulnity Security Plugin for WordPress

CVE-2026-75903

What is CVE-2026-75903?

The Vulnity Security plugin for WordPress suffers from an authentication bypass vulnerability in all versions prior to 1.4.4. This issue arises due to inadequate protection of the delegated-login pairing credential file in Nginx environments. The server configuration generated by the plugin incorrectly points to a directory path, allowing unauthorized attackers to access sensitive login credentials. This exploit enables malicious actors to forge signed REST API requests and gain administrative access to the site, thereby compromising its security.

References