CVE-2026-18786 is an improper authentication vulnerability (CWE-287) in the CheckView WordPress plugin before version 2.3.2. The plugin's REST API authentication filter is improperly applied globally to any request URI containing a CheckView-specific string, causing it to unconditionally discard authentication errors. This enables unauthenticated attackers to bypass REST nonce verification and execute privileged REST API actions as if they were logged-in administrators. The vulnerability can be exploited by tricking an administrator into opening a maliciously crafted link, potentially allowing the attacker to create new administrator accounts or perform other high-privilege actions via the REST API.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and perform any REST API action available to administrators. This includes creating new administrator accounts, leading to full site compromise with complete confidentiality, integrity, and availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the REST API endpoints and avoid opening suspicious links. Monitor for updates from the CheckView plugin vendor regarding patches or official mitigations.