Security Advisory

CVE-2026-18960

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-08-10 06:00:16

Last updated 2026-08-11 20:41:33

Assigner WPScan

CVSS score 5.4

State PUBLISHED

Description

The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked user who holds an application password created before the block to retain their full role-level read and write access through the REST API.

← Browse all CVEs View on cve.org ↗