BlogVault Backup CVE-2026-19718

Exploitation requires that the target WordPress site has at least one of the three affected plugins (BlogVault Backup & Staging, MalCare WordPress Security Plugin, or WP Remote WordPress Plugin) installed, activated, and running a version between 5.16 and 6.64 inclusive. No authentication is required and no victim interaction is needed - the unauthenticated data-leakage endpoint is accessible to any network client that can reach the WordPress installation, which for internet-facing sites means any internet user. The key limiting factor reflected in AC:H is operational: the attacker must observe enough derived-secret responses from the specific target site to reconstruct the secret via PRNG reversal, meaning exploitation is site-specific and requires a targeted collection phase rather than a single-packet trigger. Sites that have never installed these plugins are entirely unaffected. Sites running version 6.65 or later have the PRNG and leakage issues resolved and are not vulnerable.

The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately captures the dual nature of the risk: the attack is network-reachable with no authentication or user interaction required, but AC:H correctly reflects that exploitation is not trivial - the attacker must collect sufficient derived-secret data from the target and then invest computational effort to reverse the weak PRNG, making this a targeted rather than spray-and-pray attack. The EPSS score of 0.17% (6th percentile) is notably low despite the public POC, consistent with this complexity barrier; mass automated exploitation has not materialized as of analysis time. No CISA KEV listing exists, confirming no authoritative source has observed active in-the-wild exploitation. That said, the public exploit code lowers the skill threshold for targeted attacks, and the full C:H/I:H/A:H impact - resulting in complete administrative control - means the business consequence of a successful hit is severe; even a mid-sized municipal IT team in mielec managing dozens of client WordPress sites through these plugins should treat this as an urgent patch, since the per-site exploitation effort is non-zero but the payout per site is total. No conflicting signals are present: CVSS, EPSS, and KEV status are mutually consistent in indicating real but non-trivial targeted risk.

An attacker identifies an internet-facing WordPress site running a vulnerable version of BlogVault Backup & Staging by fingerprinting plugin files or HTTP response headers. Using the publicly available proof-of-concept, the attacker sends a series of unauthenticated HTTP requests that elicit responses containing data derived from the site's remote management binding secret, then applies the documented weak PRNG reversal algorithm to recover the original secret and authenticates to the remote management service with full administrative privileges, gaining the ability to install backdoors, exfiltrate content, or redirect the site.