EUVD-2026-66276
GHSA-63pv-w3j7-r654
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable with no authentication, but AC:H reflects multi-step PRNG reversal; full C/I/A warranted by resulting unrestricted administrative compromise.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The BlogVault Backup & Staging WordPress plugin before 6.65, MalCare WordPress Security Plugin WordPress plugin before 6.65, The WP Remote WordPress Plugin WordPress plugin before 6.65 do not prevent unauthenticated users from obtaining data derived from the secret that binds a site to its remote management service, and generate that secret with a weak pseudo-random number generator, allowing attackers to recover it and gain administrative access to the site.
AnalysisAI
Remote unauthenticated administrative compromise is possible across three WordPress plugins - BlogVault Backup & Staging, MalCare WordPress Security Plugin, and WP Remote WordPress Plugin - in versions 5.16 through 6.64, due to the combination of a weak pseudo-random number generator used to create site-binding secrets and unauthenticated endpoints leaking data derived from those secrets. An attacker who can observe the leaked derived values can reverse the weak PRNG to reconstruct the original secret, then authenticate to the remote management service with administrative privileges and achieve full site takeover. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site has at least one of the three affected plugins (BlogVault Backup & Staging, MalCare WordPress Security Plugin, or WP Remote WordPress Plugin) installed, activated, and running a version between 5.16 and 6.64 inclusive. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) accurately captures the dual nature of the risk: the attack is network-reachable with no authentication or user interaction required, but AC:H correctly reflects that exploitation is not trivial - the attacker must collect sufficient derived-secret data from the target and then invest computational effort to reverse the weak PRNG, making this a targeted rather than spray-and-pray attack. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is to update all three plugins to version 6.65 or later, which addresses both the weak PRNG used during secret generation and the unauthenticated data leakage. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Identify all WordPress installations running BlogVault Backup & Staging, MalCare WordPress Security Plugin, or WP Remote WordPress Plugin in versions 5.16 through 6.64, prioritizing production environments for immediate remediation. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today