The CheckView WordPress plugin before version 2.3.2 contains an authentication bypass vulnerability (CWE-287) in its REST API. The plugin's authentication filter is not limited to its own REST routes and unconditionally discards authentication errors for any request whose URI contains a CheckView-specific string. This behavior enables unauthenticated attackers to bypass REST nonce verification and execute privileged REST actions available to logged-in administrators, including creating new administrator accounts, by tricking an administrator into opening a maliciously crafted link.

An attacker can bypass authentication controls on the CheckView plugin's REST API and perform any REST action with administrator privileges. This includes creating new administrator accounts, leading to full site compromise. The vulnerability requires tricking an administrator into opening a crafted link, which could lead to unauthorized administrative control over the WordPress site.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided. Until a patch is available, administrators should avoid opening untrusted links that may exploit this vulnerability and consider disabling or restricting the CheckView plugin's REST API access if possible.