CheckView CVE-2026-18786

The target WordPress site must have the CheckView plugin installed and active in a version between 2.0.29 and 2.3.1 - no non-default WordPress configuration is required beyond the plugin being present and activated. The attacker requires no authentication of their own (PR:N per CVSS), but exploitation is entirely conditional on a logged-in WordPress administrator actively clicking a crafted link while their browser session is live (UI:R per CVSS) - this is the single limiting factor and cannot be bypassed without that interaction. The targeted REST endpoint must be one that administrators are permitted to invoke, such as user creation via wp/v2/users; standard WordPress REST API user registration capabilities must not be separately disabled. Exploitation cannot be automated at scale due to the mandatory social engineering step. There is no requirement for special server-side configuration beyond plugin activation.

The CVSS 8.8 score is justified by the full C:H/I:H/A:H impact and PR:N attack posture, but the UI:R requirement (an administrator must be tricked into clicking a crafted link) meaningfully limits autonomous exploitation and explains the very low EPSS score of 0.19% at the 9th percentile - a notable divergence from what the high CVSS might imply. This discrepancy is best read as a signal about exploitability at scale, not about severity per incident: once an administrator clicks the link, site compromise is trivially complete. Even a mid-sized municipal IT team in kielce running a CheckView-enabled WordPress installation should treat this as urgent given the minimal post-click attacker effort and the public WPScan exploit. The vulnerability is absent from the CISA KEV catalog, meaning confirmed active exploitation has not been officially recorded, but the publicly available exploit reduces the skill barrier substantially, making targeted or opportunistic social-engineering campaigns realistic. From an SSVC perspective, exploitation status would classify as 'PoC', automatable as 'No' due to the mandatory user interaction step, and technical impact as 'Total' given the administrator account creation capability. No data conflicts were observed: the CVSS UI:R aligns with the description's 'crafted link an administrator is tricked into opening', and the PR:N correctly reflects the attacker's own unauthenticated posture.

An attacker identifies a target WordPress site running CheckView version 2.0.29 through 2.3.1, then crafts a malicious URL embedding the CheckView-specific URI string while targeting the wp/v2/users REST endpoint with parameters to create a new administrator account. The attacker delivers this URL to a site administrator via email or message; when the administrator clicks the link while logged into WordPress, their browser sends an authenticated request, the plugin's global filter discards the nonce error due to the URI string match, and the REST API creates a new admin-level user on the attacker's behalf. A publicly available WPScan exploit demonstrates this exact technique.