EUVD-2026-54997
GHSA-8r6g-r9rq-8jr8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attacker is unauthenticated (PR:N) but requires an admin to click a crafted link (UI:R); full CIA impact follows from unconstrained admin REST access including account creation.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The CheckView WordPress plugin before 2.3.2 does not restrict its REST API authentication filter to its own routes and unconditionally discards the authentication error raised for any request whose URI merely contains a CheckView WordPress plugin before 2.3.2-specific string, making it possible for unauthenticated attackers to bypass the REST nonce check and perform any REST action available to a logged-in administrator, such as creating a new administrator account, via a crafted link an administrator is tricked into opening.
AnalysisAI
Privilege escalation via REST API authentication bypass in the CheckView WordPress plugin before 2.3.2 allows an unauthenticated attacker to perform any REST action available to a logged-in administrator - including creating a new administrator account - by tricking an admin into opening a crafted link. The plugin's authentication filter is applied globally to all REST routes rather than only to CheckView's own endpoints, and it unconditionally discards authentication errors for any request whose URI merely contains a CheckView-specific string, bypassing WordPress's nonce enforcement entirely. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The target WordPress site must have the CheckView plugin installed and active in a version between 2.0.29 and 2.3.1 - no non-default WordPress configuration is required beyond the plugin being present and activated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 score is justified by the full C:H/I:H/A:H impact and PR:N attack posture, but the UI:R requirement (an administrator must be tricked into clicking a crafted link) meaningfully limits autonomous exploitation and explains the very low EPSS score of 0.19% at the 9th percentile - a notable divergence from what the high CVSS might imply. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker identifies a target WordPress site running CheckView version 2.0.29 through 2.3.1, then crafts a malicious URL embedding the CheckView-specific URI string while targeting the wp/v2/users REST endpoint with parameters to create a new administrator account. The attacker delivers this URL to a site administrator via email or message; when the administrator clicks the link while logged into WordPress, their browser sends an authenticated request, the plugin's global filter discards the nonce error due to the URI string match, and the REST API creates a new admin-level user on the attacker's behalf. … |
| Remediation | Update the CheckView WordPress plugin to version 2.3.2 or later, which is the vendor-confirmed patched release per the WPScan advisory at https://wpscan.com/vulnerability/f53e1706-e926-4a2c-a2a7-465b4ca5d102/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Conduct an audit of all WordPress installations to identify CheckView plugin usage; immediately disable the plugin on any system running version 2.3.2 or earlier if immediate patching is not feasible, and restrict REST API access where possible. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today