CVE-2026-13600

Name of the Vulnerable Software and Affected Versions AutoNetTV Relay WordPress plugin versions prior to 3.0.14

Description The plugin fails to perform capability or authentication checks before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On specific server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker can trigger the task to obtain the administrator session cookie, granting full administrative access without credentials.

Recommendations Update AutoNetTV Relay WordPress plugin to version 3.0.14 or later.