The Advanced Access Manager plugin suffers from an authentication bypass vulnerability identified as CVE-2026-42674. The issue arises due to improper handling of URL encoding, enabling spoofing that bypasses authentication controls. This vulnerability affects versions through 7.1.0 and has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N), indicating network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality impact, high integrity impact, and no availability impact. No patch or official remediation level has been published by the vendor as of the current data.

Successful exploitation of this vulnerability allows an attacker to bypass authentication controls without requiring privileges or user interaction, potentially leading to unauthorized modification of data or settings (high integrity impact). There is no impact on confidentiality or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. No specific temporary mitigations are provided by the vendor at this time.