CVE-2026-18052: CWE-287 Improper Authentication in ManageWP Worker

CVE-2026-18052 is an improper authentication vulnerability (CWE-287) in the ManageWP Worker WordPress plugin prior to version 4.9.37. The vulnerability arises because the plugin does not bind the account being logged in to the signature authorizing the login, nor does it prevent replay attacks on login links. Consequently, an attacker who obtains such a login link can reuse it to gain a session as any user, including administrators, thereby compromising site security.

Successful exploitation allows an attacker to impersonate any user on the affected WordPress site, including administrators. This leads to full compromise of confidentiality, integrity, and availability of the site, as the attacker can perform any actions permitted to the impersonated user.

Upgrade the ManageWP Worker plugin to version 4.9.37 or later, where this vulnerability is fixed. Since no official patch links are provided, verify the vendor advisory or plugin update notes for confirmation of the fix. Until updated, avoid sharing login links and monitor for suspicious login activity.