CVE-2026-75903 manuelgalan CVE debrief

Who should care

WordPress site administrators using the Vulnity Security plugin, especially those with Nginx-based installations, should assess their exposure and apply patches or mitigations as necessary.

Why it matters

CVE-2026-75903 is a high-severity authentication bypass vulnerability in the Vulnity Security plugin for WordPress. It affects versions up to and including 1.4.3 and is particularly relevant for Nginx-based installations. The vulnerability allows unauthenticated attackers to retrieve stored credentials, forge signed REST API requests, and gain administrator access. WordPress administrators, especially those using Nginx, should assess their exposure and apply patches promptly.

• Potential unauthorized administrator access to WordPress sites.
• Possible retrieval of sensitive credentials by attackers.
• Potential for attackers to forge signed REST API requests.
• Need for verification of patch application and system integrity.

Technical summary

The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in versions up to and including 1.4.3. This is due to insufficient protection of the delegated-login pairing credential file on Nginx-based installations. The plugin's generated server configuration snippet guards the wrong directory path, allowing unauthenticated attackers to retrieve stored credentials, forge signed REST API requests, and log in as an administrator.

Defensive priority

High priority for WordPress site administrators using the Vulnity Security plugin, especially those with Nginx-based installations, to assess exposure and apply patches.

Recommended defensive actions

• Assess exposure by checking if the Vulnity Security plugin version is 1.4.3 or earlier.
• Verify if the WordPress installation uses Nginx.
• Apply the patch or update to a fixed version of the Vulnity Security plugin.
• Monitor for suspicious REST API requests and administrator login attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed in Vulnity Security plugin versions up to and including 1.4.3. The issue arises from the plugin's generated server configuration snippet guarding the wrong directory path on Nginx-based installations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.