ManageWP Worker CVE-2026-18052

The target WordPress site must have the ManageWP Worker plugin installed, activated, and connected to a ManageWP account, as the vulnerable login mechanism is only exercised when remote login is initiated through the ManageWP dashboard. The attacker must have obtained at least one ManageWP-generated login link for the target site - this is the primary limiting condition captured by CVSS AC:H. Such links may be exposed through unencrypted email delivery, HTTP (non-TLS) transmission, server-side request logging, browser history, or referrer header leakage. Exploitation does not require any authentication by the attacker. Once a link is obtained, there is no user interaction required and no expiry or single-use enforcement to prevent replay. The constraint is therefore access to the link itself, not any technical complexity in using it.

The CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a high-severity vulnerability with full-triad impact but acknowledges that exploitation is not trivial: AC:H captures the prerequisite of intercepting or obtaining a valid login link. The EPSS score of 0.14% (4th percentile) is notably low, indicating that despite the high CVSS, mass automated exploitation is not currently observed - a meaningful signal that this is not yet being broadly targeted in scanning campaigns. The vulnerability is not listed in CISA KEV, and no public proof-of-concept code has been identified at time of analysis. Real-world risk is therefore concentrated among sites where an attacker already has access to network traffic, server logs, browser history, or email containing ManageWP login links. For organisations using ManageWP to manage many WordPress properties - for example, a managed hosting provider or a digital agency - exposure is amplified because a single intercepted link from any managed site could yield admin access. The AC:H mitigator is genuine but not a strong shield, since login links may be transmitted over email or logged in proxy/WAF infrastructure. Prioritisation should be driven by whether ManageWP Worker is actively in use and whether login links traverse monitored or logged channels.

An attacker monitoring network traffic or with access to email or proxy logs intercepts a ManageWP-generated login link intended for a site administrator. The attacker replays this link - even if it was already used - against the target WordPress site, obtaining a fully authenticated administrator session without any credentials. From there, the attacker can install backdoor plugins, exfiltrate user data, or pivot to the hosting environment. No public exploit code has been identified at time of analysis, but the attack requires no special tooling beyond a web browser.