CVE-2026-18786

Name of the Vulnerable Software and Affected Versions CheckView versions prior to 2.3.2

Description The plugin fails to restrict its REST API authentication filter to its own routes. It unconditionally discards authentication errors for any request where the URI contains a specific string related to the plugin. This allows unauthenticated attackers to bypass the REST nonce check—a security token used to prevent Cross-Site Request Forgery (CSRF)—and execute any REST action available to a logged-in administrator, including the creation of a new administrator account, by tricking an administrator into clicking a crafted link.

Recommendations Update CheckView to version 2.3.2 or later.