EUVD-2026-96785
GHSA-p977-wr5v-fw6x
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted request to always-loaded admin handler
-
ExploitInvoke bulk password action lacking auth/nonce check
-
ExecutionReset or overwrite all post passwords
-
ImpactDisclose protected content or lock all posts
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions beyond having the vulnerable plugin installed and active - the flawed bulk post-password action runs on an ALWAYS-LOADED admin handler with NO capability check and NO nonce check, so remote unauthenticated exploitation works against default configurations of WP Posts Password Batch Manager (versions through 1.1). The only real limiting factors are: (1) the target site must have this specific, low-prevalence plugin installed and enabled, and (2) the site must have published posts whose passwords are worth resetting or overwriting. No authentication, no user interaction, and no non-default setting is required. |
| Impact | This is a genuine priority within its (narrow) deployment scope, not merely a high-CVSS paper risk. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes the easiest possible exploitation profile - remote, network-reachable, low complexity, no authentication, no user interaction - and CWE-862 (Missing Authorization) is corroborated by the description, which states no capability or nonce check guards a bulk action on an always-loaded admin handler. WPScan has published exploit material (POC: Publicly available), so weaponization effort is minimal. However, exploitation status is 'publicly available exploit code exists' - NOT active exploitation: there is no CISA KEV listing and no EPSS score was provided in the input, so real-world exploitation volume cannot be quantified and should not be assumed. The signals are internally consistent (high CVSS, clear authorization flaw, public POC all agree), with no contradictions between the vector and the description. The dominant mitigating factor is NOT technical difficulty but footprint: this is an obscure, low-install-base plugin, so aggregate risk across the internet is low even though per-instance risk for an affected site is high. The integrity impact (I:H - overwriting every published post's password) is the most serious consequence; confidentiality (C:L) and availability (A:L) are secondary. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a single crafted HTTP request to the plugin's always-loaded admin handler, invoking the bulk post-password action that lacks any capability or nonce check. Because a public POC from WPScan exists and the action requires no authentication, complexity, or user interaction, the attacker can either reset passwords to disclose protected content or set an attacker-chosen password to lock every published post site-wide. The entire attack is a one-shot remote request against the default plugin behavior. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unauthenticated attackers can reset, overwrite, or replace the post password of every published post on any WordPress site running the WP Posts Password Batch Manager plugin through version 1.1, because the plugin's bulk post-password handler is registered on an always-loaded admin handler and performs neither a capability check nor a nonce check. Successful exploitation with a single crafted request gives the attacker either disclosure of all password-protected post content (by clearing or resetting known/blank passwords) or a denial-of-service/lockout condition by setting every published post behind an attacker-chosen password, matching the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L (high integrity impact, low confidentiality and availability impact). Publicly available exploit code exists (the WPScan entry is tagged as an exploit reference), and no CISA KEV entry is associated with this CVE, so this is not confirmed as actively exploited; the practical risk is concentrated in the narrow set of sites that actually have this low-prevalence plugin installed and active, with published, password-protected content.
RemediationAI
No vendor-released patch was identified at time of analysis, so there is no fixed version to upgrade to and administrators should treat deactivation as the primary remediation: deactivate and then fully delete the WP Posts Password Batch Manager plugin from every WordPress installation, accepting the loss of its bulk password-management functionality (replace it with a maintained alternative or manual per-post editing that requires an authenticated, capability-checked workflow). If the plugin cannot be removed immediately, the practical compensating control is to block unauthenticated requests that reach its admin-side handler at the web application firewall or reverse-proxy layer, for example by denying POST requests to /wp-admin/admin-ajax.php and /wp-admin/admin-post.php whose body contains the plugin's bulk password action parameter, or by blocking that action string outright; the trade-off is that identifying the parameter reliably requires fingerprinting the plugin, WAF rules can cause false positives against unrelated admin-ajax traffic, and a determined attacker using a varied parameter name or a different request shape may bypass a signature-only rule. Restricting /wp-admin/ paths by source IP or requiring authentication in front of admin-ajax.php reduces exposure but breaks legitimate front-end AJAX features and is impractical for public sites. As a damage-limitation step for sites that may already be exposed, audit and restore post passwords from backup, review post_password and post_modified values for unexpected bulk changes, invalidate sessions, and rotate any credentials or shared secrets associated with protected content; note that any nonce- or capability-based hardening workaround requires code changes that the plugin as distributed does not provide, so such patches must be treated as unsupported customizations. Monitor the WPScan entry at https://wpscan.com/vulnerability/38498e0f-1770-4fff-a882-b11b29b15213/, the VulDB advisory at https://vuldb.com/vuln/416529, and the NVD record at https://nvd.nist.gov/vuln/detail/CVE-2026-89283 for a vendor fix, and because publicly available exploit code exists and the request is trivially unauthenticated, prioritize removal over monitoring.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-862 (Missing Authorization) compounded by the absence of a WordPress nonce check, mapped to a bulk post-password operation exposed through an admin handler that WordPress loads on every admin-side request rather than only after authentication or capability validation. In WordPress plugin architecture, registering an action on such an always-loaded or AJAX-accessible hook without a current_user_can() capability gate and without check_ajax_referer()/wp_verify_nonce() means the request can be triggered by an unauthenticated remote client; the missing nonce also means the same endpoint is cross-site request forgery-able against any logged-in user. Because the action operates in bulk over post objects, the plugin updates post_password on the entire set of published posts rather than a single item, which is why the integrity impact is rated High (I:H) while confidentiality (C:L) and availability (A:L) are limited to the exposure of protected content and the loss of normal post accessibility. The supplied CPE (cpe:2.3:a:unknown:wp_posts_password_batch_manager:*:*:*:*:*:*:*:*) lists the vendor as unknown, meaning there is no authoritative vendor-side product page or CPE normalization to rely on; ENISA EUVD tracks the same issue as EUVD-2026-96785 with an affected range of 'WP Posts Password Batch Manager 0 <= 1.1', and the reporting credit goes to WPScan, whose vulnerability entry is the primary exploitation reference. Note that the associated tags describe this as an authentication bypass affecting a WordPress plugin, which aligns with the missing-authorization class rather than a cryptographic or injection flaw.
Know when Wp Posts Password Batch Manager gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Unauthenticated network request to an unprotected always-loaded handler gives AV:N/AC:L/PR:N/UI:N; overwriting all post passwords is I:H, disclosure of protected content C:L, lockout A:L.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
3DescriptionCVE.org
The WP Posts Password Batch Manager WordPress plugin through 1.1 does not perform any capability or nonce check on a bulk post-password action that runs on an always-loaded admin handler, allowing unauthenticated attackers to reset or overwrite the password of every published post, disclosing password-protected content or locking all posts behind an attacker-chosen password.
Technical POC Analysis
CWE-862 (Missing Authorization), mapped by WPScan to OWASP A5: Broken Access Control.
Full technical POC analysis - root cause, step-by-step exploitation and patch breakdown - is part of the Pro and Business plans.
Executive ViewAI
Any WordPress site running the WP Posts Password Batch Manager plugin (through version 1.1) can have the access passwords for all of its published posts altered by an unauthenticated attacker using a single request, with no login or special privileges required. This allows an attacker to strip protection from confidential content - exposing gated material such as client resources, internal announcements, or paid content - or to lock the organization out of its own published posts by reassigning every password to a value of the attacker's choosing. Because publicly available exploit code exists and the plugin performs no authorization checks, any internet-exposed instance should be treated as an immediate operational and content-confidentiality risk requiring urgent remediation.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove WP Posts Password Batch Manager through version 1.1; block unauthenticated access to admin-ajax.php and admin-post.php via WAF or reverse proxy rules; apply virtual patching to reject requests targeting the plugin's bulk password handler that lack valid nonces or capability checks; place affected sites behind authentication or IP allowlisting; and monitor logs and post-password metadata for tampering or mass changes. Apply vendor patch when released.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB