CVE-2026-18960: CWE-287 Improper Authentication in Block User Account
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
AI Analysis
Technical Summary
CVE-2026-18960 describes an improper authentication vulnerability (CWE-287) in the Block User Account WordPress plugin prior to version 2.0.1. The plugin fails to enforce account blocks on every authentication path, specifically allowing blocked users with pre-existing application passwords to retain full role-level read and write access via the REST API. This bypass undermines the intended account blocking mechanism.
Potential Impact
Blocked users can continue to access and interact with the WordPress REST API with their full role permissions if they have an application password created before the block. This could allow unauthorized actions consistent with their role, despite the account being blocked, potentially leading to unauthorized data access or modification.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 2.0.1 or later once available, as the vulnerability affects versions before 2.0.1. Until a patch is confirmed, consider revoking all application passwords for blocked users to mitigate unauthorized REST API access.
CVE-2026-18960: CWE-287 Improper Authentication in Block User Account
Description
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18960 describes an improper authentication vulnerability (CWE-287) in the Block User Account WordPress plugin prior to version 2.0.1. The plugin fails to enforce account blocks on every authentication path, specifically allowing blocked users with pre-existing application passwords to retain full role-level read and write access via the REST API. This bypass undermines the intended account blocking mechanism.
Potential Impact
Blocked users can continue to access and interact with the WordPress REST API with their full role permissions if they have an application password created before the block. This could allow unauthorized actions consistent with their role, despite the account being blocked, potentially leading to unauthorized data access or modification.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to version 2.0.1 or later once available, as the vulnerability affects versions before 2.0.1. Until a patch is confirmed, consider revoking all application passwords for blocked users to mitigate unauthorized REST API access.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-05T14:34:53.519Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7972b2bf8831d5392fb0a1
Added to database: 08/10/2026, 06:41:54 UTC
Last enriched: 08/10/2026, 07:02:36 UTC
Last updated: 08/11/2026, 00:41:10 UTC
Views: 6
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.