EUVD-2026-55022
GHSA-qvph-jjx5-pw4h
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AC:H reflects mandatory server-side buffering configuration; PR:N because no credentials are needed; full C/I/A because admin access yields complete site control.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The AutoNetTV Relay WordPress plugin before 3.0.14 does not perform any capability or authentication check before setting a WordPress administrator authentication cookie during its scheduled content-synchronization task. On server configurations where the scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the due task can receive the administrator's session cookie and gain administrator access without credentials.
AnalysisAI
Authentication bypass in the AutoNetTV Relay WordPress plugin (all versions before 3.0.14) allows unauthenticated remote attackers to obtain a WordPress administrator session cookie by triggering the plugin's scheduled content-synchronization task under a specific server configuration. The plugin issues an admin authentication cookie during the sync task without performing any capability or authorization check, and on servers where the scheduled task completes before the HTTP response is committed, the cookie is returned to the triggering request. A public proof-of-concept exploit exists, reported by WPScan; no KEV listing has been identified at time of analysis.
Technical ContextAI
AutoNetTV Relay is a WordPress plugin (CPE: cpe:2.3:a:unknown:autonettv_relay:*:*:*:*:*:*:*:*) designed to synchronize content from an external relay service. The vulnerability is classified under CWE-287 (Improper Authentication): the plugin's scheduled cron-style synchronization handler unconditionally issues a WordPress administrator authentication cookie - a privileged session credential - without verifying that the caller holds any WordPress capability or is authenticated. This creates an unauthenticated code path to administrator credential issuance inside what is supposed to be a server-side background task. The exploitability is gated by a server-side timing characteristic: whether the WordPress cron task fully executes (and the cookie is written to the response) before the HTTP response is flushed to the client. On some server stacks (e.g., configurations where output buffering holds the response until task completion), this condition is met, making the cookie visible in the HTTP response to the attacker who sent the triggering request.
RemediationAI
The primary remediation is to update AutoNetTV Relay to version 3.0.14 or later, which resolves the missing capability check in the scheduled synchronization handler. The WPScan advisory at https://wpscan.com/vulnerability/2f69e28f-cc9f-422e-a014-662f3fddfad3/ and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-13600 should be referenced for update guidance. As a compensating control prior to patching, site administrators can disable the AutoNetTV Relay plugin entirely and re-enable it only after updating; this eliminates the vulnerable code path at the cost of halting content synchronization. Blocking unauthenticated external access to WordPress's cron endpoint (wp-cron.php) via web server rules or by disabling WP-Cron in wp-config.php and moving to a system-level cron job (which does not involve HTTP) may reduce but does not eliminate risk, since the root cause is the unconditional cookie issuance, not the cron delivery mechanism.
Same weakness CWE-287 – Improper Authentication
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today