CVE-2026-13600 describes an improper authentication vulnerability (CWE-287) in the AutoNetTV Relay WordPress plugin prior to version 3.0.14. The flaw arises because the plugin sets a WordPress administrator authentication cookie during its scheduled content synchronization task without performing any capability or authentication checks. On server configurations where this scheduled task executes before the HTTP response is committed, an unauthenticated attacker who triggers the task can receive the administrator's session cookie, thereby gaining administrator-level access without needing credentials. This vulnerability has a CVSS 3.1 base score of 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

An unauthenticated attacker can gain administrator access to the WordPress site by triggering the scheduled content synchronization task, due to the plugin setting an administrator authentication cookie without proper checks. This compromises the confidentiality, integrity, and availability of the affected WordPress installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the scheduled task trigger and monitor for unusual activity related to content synchronization tasks.