CVE-2026-18052

Name of the Vulnerable Software and Affected Versions ManageWP Worker versions prior to 4.9.37

Description An authentication bypass exists because the plugin fails to bind the account being logged in to the signature that authorizes the login. Additionally, the system does not prevent the replay of previously used login links. This allows an attacker who obtains a valid login link to establish a session as any user on the site, including those with administrator privileges.

Recommendations Update ManageWP Worker to version 4.9.37 or later.