Threat database

The Vulnity Security plugin for WordPress contains an authentication bypass vulnerability in all versions up to and including 1.4.3. This flaw arises from improper protection of a delegated-login credential file on Nginx-based setups, where the plugin's server configuration snippet incorrectly guards the wrong directory path. Exploiting this allows unauthenticated attackers to access stored credentials, forge signed REST API requests, and gain administrator access.