Vulnity Security EUVD-2026-102815

Exploitable only on Nginx-based WordPress installations running Vulnity Security ≤1.4.3 where the plugin's delegated-login pairing feature is in use and its auto-generated Nginx server-config snippet guards the wrong directory path, leaving the pairing credential file web-accessible. Limiting factors: Apache (or other) web servers appear unaffected; the delegated-login pairing credential must exist; and success depends on the flawed config snippet being active (reflected as AC:H). No user interaction or prior authentication is required (UI:N/PR:N), so against a qualifying Nginx deployment it is remotely exploitable by any unauthenticated attacker.

This is a genuine high-severity authentication bypass but with meaningful real-world constraints that temper the raw 8.1 score. The CVSS vector (AV:N/AC:H/PR:N/UI:N) correctly reflects that exploitation is network-based and unauthenticated, yet AC:H signals that success depends on a specific condition outside the attacker's control - namely an Nginx-based installation where the plugin's generated server-config snippet guards the wrong directory path. Impact is maximal (C:H/I:H/A:H) because retrieval of the pairing credential allows forging signed REST requests and full administrator takeover. No EPSS score, KEV listing, or public POC is present in the provided data, so exploitation status is 'no public exploit identified at time of analysis' - this is not currently a confirmed active-exploitation priority. The signals are internally consistent rather than conflicting: a high-impact flaw gated by a non-default server stack (Nginx) and a specific plugin feature. Net judgment: patch promptly on affected Nginx WordPress sites running this plugin, but the limited product footprint and configuration dependency make mass exploitation less likely than the headline score suggests. Apache-based installations appear unaffected per the description.

An unauthenticated attacker targeting a WordPress site running Vulnity Security (≤1.4.3) on Nginx requests the delegated-login pairing credential file, which the plugin's generated Nginx config snippet fails to protect because it guards the wrong directory path. With the stolen credential the attacker forges a validly signed REST API request and authenticates as an administrator. No public exploit code is identified in the provided data, but the attack requires only HTTP access to a vulnerable Nginx-based deployment.