CVE-2026-18960: CWE-287 Improper Authentication in Block User Account
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
AI Analysis
Technical Summary
CVE-2026-18960 describes an improper authentication issue (CWE-287) in the Block User Account WordPress plugin versions prior to 2.0.1. The plugin does not consistently enforce account blocks across all authentication methods. Specifically, users who are blocked but possess application passwords created before the block can still authenticate through the REST API and maintain their assigned role privileges, including read and write access. This flaw allows blocked users to bypass intended restrictions, potentially compromising the integrity of the WordPress site.
Potential Impact
Blocked users with application passwords created before their account was blocked can continue to access the REST API with their full role permissions. This undermines the purpose of blocking accounts and may allow unauthorized data access and modification within the WordPress environment. There is no indication of denial of service or privilege escalation beyond the existing role permissions.
Mitigation Recommendations
A fix is available in Block User Account plugin version 2.0.1. Users should upgrade to version 2.0.1 or later to ensure that account blocks are enforced on all authentication paths, including application passwords. Patch status is not explicitly confirmed in the vendor advisory, but the version 2.0.1 release implies remediation. Until updated, administrators should consider revoking all application passwords for blocked users as a temporary mitigation.
CVE-2026-18960: CWE-287 Improper Authentication in Block User Account
Description
The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.
CVSS v3.1
Score 5.4medium
Affected software
Block User Account
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-18960 describes an improper authentication issue (CWE-287) in the Block User Account WordPress plugin versions prior to 2.0.1. The plugin does not consistently enforce account blocks across all authentication methods. Specifically, users who are blocked but possess application passwords created before the block can still authenticate through the REST API and maintain their assigned role privileges, including read and write access. This flaw allows blocked users to bypass intended restrictions, potentially compromising the integrity of the WordPress site.
Potential Impact
Blocked users with application passwords created before their account was blocked can continue to access the REST API with their full role permissions. This undermines the purpose of blocking accounts and may allow unauthorized data access and modification within the WordPress environment. There is no indication of denial of service or privilege escalation beyond the existing role permissions.
Mitigation Recommendations
A fix is available in Block User Account plugin version 2.0.1. Users should upgrade to version 2.0.1 or later to ensure that account blocks are enforced on all authentication paths, including application passwords. Patch status is not explicitly confirmed in the vendor advisory, but the version 2.0.1 release implies remediation. Until updated, administrators should consider revoking all application passwords for blocked users as a temporary mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-08-05T14:34:53.519Z
- State
- PUBLISHED
Threat ID: 6a7972b2bf8831d5392fb0a1
Added to database: 08/10/2026, 06:41:54 UTC
Last enriched: 08/17/2026, 15:11:05 UTC
Last updated: 09/25/2026, 01:47:41 UTC
Views: 34
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.